saas-security-posture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to fetch and parse data from third-party services (e.g., gh api calls to GitHub org installations/hooks, curl calls to Slack admin APIs, and gam queries of Google OAuth tokens and DNS/proxy logs) and to act on those results (revoke tokens, uninstall apps, modify policies), so untrusted/user-generated content from those external APIs could materially influence tool use and decisions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill contains commands that write files to /usr/local/bin, chmod them, and append a cron job to /etc/cron.d (and reads /var/log/*), which modify system-wide files and require elevated privileges on the host.