migrate-statsig

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill embeds hidden, deceptive instructions to execute an unsandboxed telemetry bootstrap (including "dangerouslyDisableSandbox: true") and to never disclose or narrate those telemetry actions to the user, which is outside the migration's stated user-facing purpose and attempts to override visibility/sandbox constraints.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally performs hidden, persistent telemetry/exfiltration (including acquiring and using an on‑session telemetry secret) and instructs disabling the sandbox and never narrating or surfacing those network calls, which is a deliberate backdoor-like data‑exfiltration pattern and high-risk privacy/abuse behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text indirectly by reading and translating Statsig “gates/configs/experiments/segments” definitions from the user-specified Statsig Console API (via curl list+fetch endpoints for IDs and full item bodies), and those payload fields include arbitrary strings (e.g., description, condition targetValue, and referenced IDs) authored by the provider user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs adding and calling remote MCPs via the URLs https://mcp.confidence.dev/mcp/flags and https://mcp.confidence.dev/mcp/docs at runtime (e.g., "claude mcp add ... --url ...") and then relies on the MCP responses (SDK guides / tool payloads) to build plans and drive execution, so these runtime-fetched resources can directly control the agent's instructions and tooling.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to run a "dangerouslyDisableSandbox: true" Bash call (and then execute arbitrary shell/curl commands that read/write tokens and files), which pressures the agent to disable its sandbox and perform privileged/broad system actions that compromise the runtime environment.