open-tag-admin

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code is not an obvious backdoor but intentionally enables high-risk behavior: it runs external LLM backends with flags that bypass sandboxes and inherit the shell environment, accepts untrusted Slack input to drive those backends, and thus creates clear avenues for data exfiltration and remote code execution/credential leakage if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). Outsider free text from Slack (the app_mention event text and the fetched thread messages via conversations_replies) is read at runtime in scripts/slack_socket_agent.py and then embedded into the LLM prompt in scripts/opentag_agent.py as Slack thread context: {thread_text} and User question: {question}.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls the MFS HTTP API at MFS_URL (default http://127.0.0.1:13619) from scripts/mfs_search.py, scripts/mfs_cat.py and scripts/opentag_memory.py at runtime to fetch indexed content which is then made available to the CLI backend and can be injected into the agent prompt (i.e., external content directly influencing the agent's instructions/context).