agentiko-worker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the worker LLM context via runtime HTTP fetching/scraping of public web pages (e.g., the Vercel RSC extraction flow in references/rsc-extraction.md uses curl to download arbitrary target HTML, which is then decoded/parsed into plaintext that the agent would summarize).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to bypass a host-level security scanner (Tirith) by using terminal/python/heredoc/base64 workarounds and to write scripts and install cron jobs under /root, which enables persistent modifications and evades tooling protections on the machine.