ai-automation-workflows

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a legitimate workflow guide, but its error-alert pattern sends command output, which may contain prompts or data, to an external webhook that the skill never explains beyond a placeholder, a data flow the user would not necessarily expect.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The sequential pipeline in Pattern 2 runs tavily/search-assistant on a topic query and feeds the returned web search results into the article-writing and social-post prompts, so outsider-authored web content reaches the LLM, but only after the script issues a search rather than from a queue an outsider can push into.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill mainly runs the belt CLI for AI generation, but it also tells the agent to persistently modify the machine via crontab -e and to write logs under /var/log, which is a mild, ambiguous system-state change that the recall-first rule pushes slightly upward.