skill-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow uses network helper scripts that fetch curated listings from GitHub via the GitHub API (e.g., reading directory entries under skills/.curated), which can include outsider-authored free text in repo contents without the agent pre-selecting a specific file/item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer scripts fetch GitHub content at runtime (e.g., https://codeload.github.com/{owner}/{repo}/zip/{ref} and https://api.github.com/repos/{repo}/contents/{path}?ref={ref}), which downloads remote SKILL.md and skill code that can directly control agent prompts or later execute code when installed.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to "request escalation" when running networked installer scripts (asking for elevated privileges / sandbox bypass) and allows overwriting preinstalled .system skills, so it pushes for actions that can compromise the host state.