security-incident-response

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The companion-check section instructs the agent to run filesystem commands and install packages (ls and npx) which are unrelated to incident response and attempt to access/modify the host environment, constituting a hidden/deceptive instruction outside the skill's stated purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md "Companion check" workflow explicitly tells the agent to run commands that may install external packages (e.g., "npx skills add ...") and to compare/install recommended companion skills from third‑party sources, and the playbooks also direct submitting artifacts to public services like VirusTotal — together these steps require fetching and ingesting untrusted public content (npm packages, web services) that can materially change the agent's capabilities or influence actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to run shell commands (ls) and optionally install companion skills (npx), and its forensic/containment playbooks direct privileged, state-changing actions (memory dumps, disk images, revoking credentials, isolating hosts, modifying persistence like cron/authorized_keys) that would modify the host and often require elevated privileges.