version-check

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow fetches outsider-authored free text from the public web at runtime—e.g., curl -sL https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md and GitHub issue search results via gh api—and that fetched prose/issue text can be ingested into the agent’s LLM context for analysis.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt directs inspecting and changing installed software and containers (e.g., npm install -g to pin/rollback, disabling the auto-updater via the repo setup, docker exec into containers), which modify system state and may require elevated privileges.