gitops-workflow

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill contains a hidden HTML comment "security-allowlist: curl-pipe-bash" which is a covert instruction allowing risky curl|bash execution outside the documented, visible guidance and thus constitutes a hidden/deceptive directive.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses GitOps controllers (ArgoCD/Flux) to pull desired-state manifests from external Git repositories (e.g., repoURL: https://github.com/org/gitops-repo / url: https://github.com/org/my-app), and those repos’ YAML/markdown content is ingested as readable text into the system for reconciliation—an outsider-authored source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime commands that fetch and execute remote content (e.g., kubectl apply -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml, curl -s https://fluxcd.io/install.sh | sudo bash) and configures ArgoCD/Flux to pull Git repositories at runtime (e.g., https://github.com/org/gitops-repo, https://github.com/org/my-app), so external content will be fetched and executed by the operators/CLI during runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged commands (e.g., "curl ... | sudo bash") and applies manifests that modify system/cluster state (kubectl apply), which asks for sudo privileges and can change the machine/cluster state—so it should be flagged.