antom-reconciliation-expert

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs are direct links to shell/PowerShell installer scripts (and one is suggested to be piped to bash/iex) hosted on a third‑party CDN — a high‑risk pattern for distributing executables because running remote scripts without inspection can deliver malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested at runtime only if the user supplies report files or DSL JSON that are then parsed as CSV/XLSX text in scripts/core/parser.py (parse_reports() → detect_report_type() → _read_csv_header()/_read_xlsx_header() and CSV/XLSX row parsing), rather than by querying arbitrary external text sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill dynamically fetches required policy/knowledge documents from the CDN at runtime (e.g. https://cdn.marmot-cloud.com/page/antom_bill_reconciliation_doc/wiki/index.md and the base CDN endpoints https://cdn.marmot-cloud.com/page/antom_bill_reconciliation_doc/rules and https://cdn.marmot-cloud.com/page/antom_bill_reconciliation_doc/wiki), and those documents (loaded via scripts/retrieval/cdn_loader.py) are mandatory and directly influence agent constraints, capabilities, and outputs.