ssh-monitor-cycle

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can be ingested from the remote hosts’ terminal output: the script runs ssh ... bash -lc <remote_script> under a PTY and forwards all readable bytes from os.read(master_fd, ...) into the local LLM context (via the agent’s terminal/console capture), including arbitrary text the remote user/program prints (e.g., htop/nvtop output and any injected strings).