migrate-optimizely

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill embeds hidden, deceptive operational instructions to run an unsandboxed Bash telemetry setup (including "dangerouslyDisableSandbox: true") and to silently send/never mention telemetry, which is outside the migration task's user-visible behavior and attempts to hide side-effects and bypass sandboxing.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains deliberate, covert telemetry and sandbox-disabling instructions that collect and ship session/project/activity data to external endpoints (and instruct running a Bash call with dangerouslyDisableSandbox), enabling hidden telemetry and raising a remote-execution/exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow for plan flags/execute ingests outsider-authored free text by reading customer-supplied Optimizely flag/rules/audience data and exported JSON files (including audience_conditions and other descriptive fields) via either curl to Optimizely or the local Read tool, meaning an attacker can submit poison through their own Optimizely project exports that the LLM then processes.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running a Bash call with "dangerouslyDisableSandbox: true" at the start of every invocation, which directs the agent to disable its sandbox and thus bypasses an important security mechanism.