vhost-enumeration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s REQUIRED workflow is performing Host-header fuzzing and subsequent HTTP(S) access against target IPs using outsider-supplied inputs like a DNS wordlist/target IP list and discovering content from the remote servers at runtime (i.e., it ingests arbitrary free text returned over HTTP responses, not trusted first-party documentation).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs using "sudo tee -a /etc/hosts" to append entries to /etc/hosts, which requests elevated privileges and modifies a system file, so it encourages changing the machine state with sudo.