agy-cli-agent

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation intentionally demonstrates and normalizes a headless CLI flag (--dangerously-skip-permissions) and examples that inject arbitrary local files into remote model prompts (via cat ... passed to agy), enabling silent exfiltration of local data to external LLM servers and background operation without user consent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow shown in SKILL.md uses the local files agents/persona.md (persona) and target.py/<INPUT_FILE>/--prompt "<INSTRUCTION>" provided by the caller via run_agent.py/agy, so any outsider-authored free text is ingested directly by the model when supplied as those inputs/instructions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs and repeatedly uses the CLI flag "--dangerously-skip-permissions" (and run_agent.py auto-invokes it), which bypasses permission prompts and encourages skipping security checks — a direct mechanism to compromise the host state.