k8spider

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill contains examples instructing the user to download a binary from a placeholder attacker URL (https://ATTACKER/k8spider), which represents a suspicious software download source.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill prompt instructs the agent on how to use a Kubernetes reconnaissance tool, but it explicitly suggests downloading a binary from an external attacker-controlled or arbitrary URL via curl and executing it, which presents a security risk to the machine's state.