coding-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and README explicitly instruct the agent to fetch and operate on public, user-authored sources (e.g., "git clone https://github.com/user/repo.git", "git fetch origin '+refs/pull/*/head:...'", and running "kiro-cli chat --no-interactive --trust-all-tools 'your query'"), which means the agent will read and act on arbitrary untrusted third‑party content (public GitHub repos/web results) that can materially influence tool use and decision-making.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt explicitly promotes bypassing sandboxing and auto-approvals (e.g., Codex --yolo, Kiro --trust-all-tools, and an "elevated" host mode) which encourages running agents with host-level access and disabling security controls, enabling arbitrary and potentially privileged changes to the machine.