worker

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository contains deliberate instructions to evade a host security scanner (workarounds to bypass write restrictions), guidance to use anonymous networking (Tor) and shared SSH keys with host-key checking disabled, and steps to create persistent cron-based recon — patterns that enable covert access, persistence, and evasion of detection.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow can fetch outsider-controlled public web content at runtime (the Vercel/Next.js RSC extraction recipe in references/rsc-extraction.md runs curl -sL "https://target.com" and then parses that page text), which that extracted free-form content would be fed back into the agent’s LLM context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt explicitly teaches and encourages bypassing the Hermes/Tirith write_file security scanner (use terminal Python open(), heredoc, base64 chunking, delegate_task workarounds) and provides commands that reference host-only SSH keys, which are direct instructions to circumvent protections and alter system state.