aig-agent-redteam

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.85). Several links are suspicious: a direct .zip on an untrusted host (possible malware archive) and multiple internal/placeholder HTTP hosts (192.168.x, host:port, {target}/{url}) that can be abused for SSRF or to fetch malicious payloads; the well-known GitHub/Tencent and HuggingFace links are benign.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repo intentionally implements red‑team/jailbreak tooling (operator templates and encodings) that enable prompt injection, persistent memory-triggered exfiltration, tool-output/data extraction, file writes and obfuscation—behaviors consistent with deliberate backdoor/data-exfiltration capabilities despite "authorized" testing framing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 运行时读取的可变更内容来自“被测 target 的观察/返回”（包含外部注入载体如 indirect payload 的外部文档片段、tool/RAG/MCP 返回），Agent 会把这些内容纳入对话与证据链；且该读入由用户提供的 target 交互触发，因此存在被外部作者文本喂入的间接注入风险。