heretic

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required runtime workflow includes a “discover” path that routes live web extraction through the scrapling skill, meaning outsider-authored free text from public web pages can be ingested into the agent’s LLM context via that scraping-to-text step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installer and plugin commands fetch and install/clone remote code (e.g., pip/uv/git/npx) from https://github.com/p-e-w/heretic and https://github.com/akillness/jeo-skills during install/runtime, which will execute that external code and the skill depends on it.