skill-comply

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code intentionally sends local content and traces to an external "claude" process (including whole sandbox via --add-dir and trace inputs), and it executes LLM-produced shell setup commands without validation — together these enable straightforward data exfiltration and remote-command/backdoor abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text is ingested into the classifier LLM context via scripts/classifier.py → classify_events() where it builds {tool_calls} from ObservationEvent.input/output parsed from claude -p stream-json traces; those fields include arbitrary tool inputs/outputs produced during scenario execution (not authored by the operating user), which the LLM then reads for classification.