sync-melech-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). sync-melech-skills’ runtime workflow runs scripts/sync.py → scripts/status.py, which fetches and parses GitHub-authored text like README.md “## Workflow bundles” and each remote skills//SKILL.md frontmatter (e.g., descriptions) and includes it in the resulting JSON output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). status.py fetches the remote GitHub repo tree and raw files at runtime (e.g. https://api.github.com/repos/{owner_repo}/git/trees/{ref}?recursive=1 and https://raw.githubusercontent.com/{owner_repo}/{ref}/{path}) and that fetched metadata drives sync.py to run npx skills add/update commands that install/execute remote skill code (canonical repo https://github.com/AdirD/agent-shell-hamelech), so remote content directly controls which code is executed.