claude-code

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly documents using WebSearch/WebFetch flags and adding MCP servers (e.g., GitHub, Puppeteer/http transports) under "MCP Integration" and tool flags, which lets the agent fetch and read open/public third-party content (web pages, GitHub issues, etc.) that could contain untrusted, user-generated instructions influencing subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt explicitly teaches automating and bypassing Claude Code's permission dialogs (e.g., --dangerously-skip-permissions and scripted tmux send-keys to accept the warnings) and encourages enabling/whitelisting tools like Bash/Write and installing/managing local MCP servers—actions that allow arbitrary shell commands and file writes and therefore can compromise the host state.