kubernetes-k3s

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs fetching and executing public third‑party content (e.g., "curl -sfL https://get.k3s.io | sh -s -", "kubectl apply -f https://github.com/.../cert-manager.yaml", and applying other GitHub-hosted manifests), so the agent/workflow would ingest and act on untrusted public web content that can change behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains runtime commands that fetch and execute remote content—e.g. "curl -sfL https://get.k3s.io | sh -s -" (installs K3s by piping a remote script to sh) and "kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml" (applies remote manifests), both of which execute remote code during setup and are presented as required installation steps.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs installing system services (curl | sh to install K3s), running sudo commands, copying/modifying files under /etc/rancher, and other cluster-level operations that require root and modify the host system state, so it pushes the agent to change the machine's state.