setup-project

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask the user for database/SMTP credentials and to insert those secrets verbatim into terraform.tfvars, connection strings, and env values (e.g., DATABASE_URL, MAILER_PASSWORD), which forces the LLM to handle and output secret values directly, creating a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.85). The content contains deliberate indicators of potential backdoor/data-exfiltration intent — hardcoded external domain and SMTP settings (viktorbarzin.me) that would route traffic and emails to a third party, instructions to place service APP_URL and SMTP under that domain, guidance to add secrets (terraform.tfvars) and commit them to git, and permissive NFS/ shared services patterns (777 NFS perms, unauthenticated Redis, shared DB endpoints) that together enable credential/ data leakage and external interception even though no explicit obfuscated payloads or reverse shells are present.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill's Research Phase explicitly requires visiting GitHub repositories and checking README/docker-compose/releases (public, untrusted third-party content) and uses that information to choose images, environment variables, ports, and deployment steps, so external repo content can materially influence actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill pulls and runs container images from external registries at deployment time (e.g., ghcr.io// or Docker Hub /), which are fetched during runtime and execute remote code in the deployed containers.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs privileged, state-changing actions—e.g., SSH as root to create NFS directories, configure TrueNAS exports, run terraform apply that changes cluster resources and mounts on nodes—so it pushes the agent to perform elevated operations that modify machine/cluster state.