apple-container

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two URLs point to remote kernel archive downloads on untrusted/example domains (https://example.com/kernel.tar and https://ex.com/kata-static.tar.xz) which are direct, non-official kernel sources and represent a high-risk vector for distributing malicious binaries or tampered kernels.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime the CLI reads outsider-authored free text when it fetches arbitrary container image artifacts (e.g., via container image pull/build contexts), and those images’ metadata/content are ingested/parsed by the runtime/builder.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The docs include runtime actions that download and install remote executables/images (e.g. instructing users to download the signed installer from https://github.com/apple/container/releases and to pull or set kernel/image tarballs like https://example.com/kernel.tar / https://ex.com/kata-static.tar.xz and default images ghcr.io/apple/container-builder-shim/builder:, ghcr.io/apple/containerization/vminit:, docker.io/library/alpine:latest), which would fetch and execute remote code as part of setup—so these are runtime external dependencies.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs installing a signed .pkg that requires entering an admin password to place files under /usr/local, starting/stopping launchd-backed system services, and performing kernel installation and DNS changes — all actions that modify system files or require elevated privileges.