discover-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include unverified remote ZIP install URLs hosted on a non-official CDN (cdn.skillradar.quest) and an external API endpoint (api.skillradar.quest) used to deliver install links, creating a supply-chain risk because remote ZIPs can carry malware and there is no integrity verification.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill deliberately sends user-provided task text to a hardcoded third‑party API and instructs agents to download and extract unverified ZIP packages into persistent hidden skill directories (supply‑chain and privacy risk); no obfuscated payloads or active backdoor code are present in the source files.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 在运行时通过 scripts/discover.py 向外部 SkillRadar API 发起请求并读取其返回 JSON（含 name/description/match_reasons 等文本字段），这些外部服务返回的“候选技能描述”等自由文本会进入代理的上下文用于展示/决策。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bundled discovery script calls the runtime API at https://api.skillradar.quest and the skill instructs downloading remote ZIPs such as https://cdn.skillradar.quest/skills/extract-action-items/skill.zip?v=1738300000 (and the template https://cdn.skillradar.quest/skills/xxx/skill.zip?v=1738300000), which are used at runtime to return install links and to fetch executable skill packages — a required external dependency that can deliver and control installed code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill instructs the agent to download, unzip, execute a local script and automatically install remote "skills" into project or user global directories (modifying the filesystem and running code), but it does not ask for sudo, system-level changes, or creation of user accounts.