application-modeling

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow explicitly instructs downloading resource type YAML from the community repo "resource-types-contrib" and registering/publishing recipes from public OCI registries (e.g., ghcr.io, myregistry, host.docker.internal examples) — untrusted third‑party artifacts that the agent/Radius will ingest and whose recipe contents directly affect provisioning and subsequent tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill uses OCI registry artifact URLs that are fetched and executed at runtime by the Radius control plane (e.g., br:biceptypes.azurecr.io/radius:latest and br:myregistry.azurecr.io/recipes/postgresql-kubernetes:latest or ghcr.io/radius-project/recipes/azure-postgresql:latest), and those fetched recipes/extensions/images contain IaC/container images that will be executed—so external content can run remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes explicit host-level commands that modify system files (e.g., creating /etc/containerd/certs.d, writing hosts.toml) and restart system services (systemctl restart containerd) via docker exec, which instructs changing the machine's state and service configuration.