[PROMPT_INJECTION]: The file AGENTS.md contains a 'RULE 0
THE FUNDAMENTAL OVERRIDE PREROGATIVE' which explicitly instructs agents to ignore subsequent guidelines in favor of direct user overrides. It uses phrases like 'I AM IN CHARGE, NOT YOU' and 'YOU MUST LISTEN TO ME', which are classic adversarial prompt injection patterns aimed at bypassing agent safety filters.
[REMOTE_CODE_EXECUTION]: The README.md and SKILL.md files promote a one-liner installation method that pipes remote content directly into a shell: curl -fsSL https://raw.githubusercontent.com/.../install.sh | bash. This executes unvetted scripts from a personal GitHub repository at runtime.
[CREDENTIALS_UNSAFE]: Multiple files in the fuzz/corpus/fuzz_redact_secrets/ directory contain hardcoded sensitive string patterns including GitHub Personal Access Tokens (ghp_), OpenAI API keys (sk-), and database credentials. While intended for testing redaction, their presence as raw literals in the skill package is a high-risk finding.
[PERSISTENCE]: The install.sh script attempts to modify the user's shell profile files (.zshrc, .bashrc) to permanently alter the PATH environment variable, ensuring the cass binary remains executable across sessions.
[EXTERNAL_DOWNLOADS]: The skill's installation and update mechanisms fetch binaries and scripts from various external sources, including https://sh.rustup.rs and the author's GitHub repository. Automated scanners flagged several of these URLs as untrusted RCE vectors.
[DATA_EXFILTRATION]: Automated URLite scans detected the presence of phishing domains, specifically https://attacker.example.com, within the project files. This suggests a risk of sensitive data being routed to malicious external endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant indirect injection surface as it is designed to ingest and index data from 26 different external agent harnesses.
Ingestion points: The src/connectors/ module reads session logs from diverse third-party applications.
Boundary markers: The skill uses [Tool: Name] delimiters, but these are for display/indexing and do not inherently prevent the LLM from following instructions embedded in the logs.
Capability inventory: The project includes scripts that utilize subprocess.run() and os.system() to execute shell commands, providing a path for injected instructions to reach the system level.
Sanitization: While secret redaction logic is present, it relies on regex patterns that can be bypassed by sophisticated adversarial content in the ingested logs.
[DYNAMIC_EXECUTION]: Python scripts such as scripts/e2e/live_fleet_search.py and scripts/historical_recovery/recover_historical_bundle.py use the subprocess module to dynamically construct and execute shell commands based on runtime parameters.

cass