skf-quick-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The workflow explicitly fetches and reads public, user-generated content (README, manifests, entry-point source files, and web-search results) from third-party sites like GitHub and public registries — see Step 1 (registry-resolution/web-search fallback) and Step 3 "Quick Extract" ("Read README" and "Fetch Source Files") — and that extracted content is parsed and used to drive extraction, compilation, gating decisions, and outputs, so it can materially influence agent behavior and enable indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches repository content at runtime (e.g., via GitHub API calls like "gh api repos/{owner}/{repo}/contents/{path}?ref={source_ref}") and injects README/manifest/entry files into the extraction/LLM pipeline to generate SKILL.md, so remote GitHub content directly controls prompts and is a required dependency.