clone-repo

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill ingests outsider-authored free text by cloning a user-supplied external repository URL at runtime (git subtree add ... <url> <branch>), which brings in that repo’s source files (readable text) into repos/<name>/ and then updates AGENTS.md to direct the agent to use it.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs git network commands at runtime (git ls-remote and git subtree add/pull) to fetch a user-supplied clone URL (the runtime , e.g. https://... or git@github.com:org/repo.git), importing repository files into repos// which are then injected as reference material that will directly influence agent prompts/behavior.