semble

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md and examples explicitly show indexing and searching remote public git repositories (e.g., "Index a remote git repo without cloning first", the Python call SembleIndex.from_git("https://github.com/...") and CLI examples), so the agent fetches and reads untrusted, user-generated repo content that can influence its subsequent decisions and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly supports indexing remote Git repositories at runtime (e.g., "semble search ... https://github.com/MinishLab/model2vec"), which fetches remote code and returns those snippets into agent context (thus directly controlling prompts), so the GitHub URL pattern used at runtime is a risky external dependency.