setup-routines

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs extracting tokens (e.g., "sk-ant-oat…") and writing them into an env file, which requires the agent to read/handle secret values and could cause those secrets to appear verbatim in commands, files, or outputs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly instructs persistent unattended scheduling, writing long-lived credentials to disk, and bypassing permission/trust checks — behaviors that enable credential persistence, unattended remote execution, and easy abuse/exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s required runtime workflow ingests outsider-authored text from the repo itself—via .claude/routines/catalog.json and templates/*.md read at runtime (used for routine selection and prompt rendering) which are authored/submitted by the repo owner.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches and uses repository-provided prompt templates at runtime (the session clones declared sources such as "Owner/repo" and "Owner/other-repo"), so those external git sources directly control prompts executed by the agent.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent to create or modify a system crontab ("Durable local scheduling = system crontab") and to write an idempotent marker block into the crontab, which are durable system changes that typically require elevated privileges and can alter the machine's state.