penetration-testing

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The "Companion check" secretly instructs the agent to run local shell commands (ls of ~/.claude/... and offer npx installs) to inspect and modify the host environment—an out-of-scope, operational instruction that effectively requests local filesystem access and installs, which is hidden/deceptive relative to the pentesting guidance.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill includes an explicit "companion check" that tells the agent to run local filesystem commands (ls through hidden skill directories) and to offer/perform installs via npx skills add ..., which would read local files and can modify the host by installing packages (even though it does not request sudo, create users, or directly edit privileged system files).