truto-operator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In P0/P2/P3/P4/P5/P6 the agent ingests outsider-authored free text that users paste/share (e.g., “exact error text / HTTP status” or “reported wrong/missing data” and error bodies) via runtime reads through call_platform_api response bodies and possibly GET /log, so the workflow consumes untrusted content without first selecting a specific item from the trusted source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the assistant to read runtime playbooks/skill references (e.g. truto://skill/index and truto://skill/{id}/references/{slug}, plus concrete refs like truto://skill/truto/references/sync-jobs) via the read_platform_resource/meta-tool at runtime, so those truto://skill:// URIs are fetched during execution and can directly control agent instructions.