handoff-execute

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains high-risk capabilities that allow executing arbitrary commands from a received brief, reading/writing arbitrary local files (including a brief-controlled output_location), and fetching external URLs — enabling remote code execution and data exfiltration if briefs are untrusted or malicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md describes Phase 2 “Source ingestion” where /handoff-execute reads @SOURCES.required entries from the handoff brief (including wikilinks and URLs), and those sources are outsider-authored free text when the brief author points to public web content or other non-user-authored documents at runtime.