watermarks-remover

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow only ingests user-provided local files/text via commands like inspect_file.py/clean_file.py (and optional audit_dir.py for a user-supplied directory), without any queue/feed or forced selection of outsider-authored free text; the only remote-read behavior is explicit website auditing via a user-supplied sitemap URL, and that still requires the user to choose the specific external content to fetch.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs git clone --depth 1 https://github.com/guillaumemeyer/watermarks-remover.git and then runs Python scripts from that checkout, so remote code at that URL is fetched and executed at runtime (https://github.com/guillaumemeyer/watermarks-remover.git).