landing-page-conversion-audit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These links point to a GitHub repository and the raw docker-compose.yml that the skill tells users to curl and run with docker compose — running third‑party docker-compose files (which can pull and run arbitrary images/commands) from an unknown repo is potentially dangerous; the localhost URL itself is benign.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests and reads a user-supplied “Page URL” by fetching and analyzing the rendered DOM of a live landing page, which is outsider-authored free text.