palmier-pro

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes an MCP server on the local endpoint (http://127.0.0.1:19789/mcp) where every session begins by calling get_timeline and further tool calls operate on timeline content that the MCP client can read/edit, meaning outsider-authored input delivered to the MCP client can be used to supply free text (e.g., prompts for generate_* and transcript/text edits) into the runtime workflow without any intermediate “select a specific trusted item” step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged https://github.com/palmier-io/palmier-pro because the skill explicitly instructs git-cloning that repository and then building/running it (swift build / swift run), which fetches remote code and executes it as part of the provided setup/runtime steps.