oss-bucket-exploit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow involves downloading and interacting with files stored inside third-party object storage buckets (AWS S3, Alibaba Cloud OSS, Tencent Cloud COS, etc.) using CLI tools or API calls, which allows external attackers who populate these buckets with malicious files to inject free text into the agent's runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to download and install a binary directly into a system directory (/usr/local/bin/) using root privileges without checking for permissions or safety, which compromises the state of the machine.