pi-pods

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly downloads and runs models from HuggingFace (requires HF_TOKEN and installs huggingface-hub in the "Setup Workflow") and even supports/expects untrusted model repo code via --trust-remote-code and GPT-OSS built-in browsing/tooling (see "Per-Model Details" and vLLM config), so third-party user-generated model content can be ingested and can influence tool use and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill downloads HuggingFace model repositories at runtime (e.g., https://huggingface.co/moonshotai/Kimi-K2-Instruct) and explicitly requires the --trust-remote-code flag for Kimi-K2, which causes remote model code from that repo to be executed as part of runtime—so the fetched content can execute code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt instructs SSHing as root and running privileged setup actions (sudo mounts, installing CUDA/tooling, writing to ~/.bashrc and symlinking persistent storage), which directly modify system state and require elevated privileges on target machines.