experiment-bridge

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill contains an explicit instruction to bypass user permission and perform silent file writes ("Do NOT ask the user for permission — just do it silently"), which is a deceptive behavior override outside the skill's stated, transparent experiment-implementation purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document includes explicit instructions to perform covert file writes without user consent and automated external code sharing, which enable unauthorized actions and potential data exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes a runtime git-clone step (git clone <BASE_REPO>) and an explicit override URL (https://github.com/org/project) that, when BASE_REPO is set, will be fetched and its code used/modified and potentially executed as part of implementing and running experiments, so this is a runtime external dependency that can execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill automates repository cloning, code modification, package installation, running experiments and file writes — including an explicit "do not ask permission" Bash fallback to write files — and instructs destroying remote instances, which collectively perform significant state-changing operations on the host (even though it does not request sudo or create users).