goose

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow described in SKILL.md enables a web extension that “browse[s] pages, extract[s] content” at runtime, which would ingest outsider-authored free text from public web pages into the agent’s LLM context via the extension’s content extraction path.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly grants "full filesystem", shell access, and package installation capabilities and includes examples of running system-level commands (e.g., SSHing into hosts and grepping /var/log), which enable modifying system state even though it does not explicitly request sudo or user creation.