langfuse-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source and runtime path: The workflow uses the scripts/langfuse-cli wrapper to invoke mcp2cli (exec .../mcp2cli @langfuse-cli "$@"), and at runtime the tool calls (e.g., fetch-traces, list-prompts, fetch-trace, annotation queue item listing) read Langfuse data that can include outsider-authored free text (stored prompts/traces/observations/session content) if the user’s Langfuse project contains it.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly advises clearing, chown-ing, or removing a root-owned wrapper log file, which are filesystem-modifying actions that can require elevated (sudo) privileges and thus could compromise the machine state.