base-images-and-rpms

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The bundle installs a Python package directly from a GitHub archive belonging to an unverified user (konflux-ci), which is an untrusted source for executable code and therefore could be used to distribute malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The automation downloads and executes remote scripts and installs a pip package from external sources without integrity checks (curl + chmod +x and pip install), creating clear supply‑chain / remote‑code‑execution risk if those upstream artifacts are compromised.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Yes: in the required workflow, scripts/base-images-and-rpms.sh fetches outsider-authored free text (GitLab-hosted shell scripts) at runtime via curl (fetch_gitlab_script → resolve_update_base_images_script), and those scripts are then executed by the agent, placing their contents into the runtime LLM context indirectly through tool execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill downloads and executes remote scripts at runtime from the GitLab raw URL (https://gitlab.cee.redhat.com/rhidp/rhdh/-/raw//build/scripts/updateBaseImages.sh and createPR.sh) via curl and also installs/executes rpm-lockfile-prototype from https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip, so fetched content is executed as part of the workflow.