omcustom-release-notes

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt includes an explicit instruction to force mode: "bypassPermissions" when spawning agents, which overrides permission prompts and alters agent security behavior unrelated to generating release notes, so it is a deceptive/out-of-scope instruction.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill explicitly runs gh issue list --state closed ... --json number,title,labels in Phase 1 to ingest GitHub issues (user-generated, potentially public third-party content) which the agent reads and uses to generate release notes that are then fed to gh release create and other actions, so external issue text can materially influence agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly instructs spawned agents to use mode: "bypassPermissions" (circumventing agent permission prompts), which is a directive to bypass security controls even though most other actions only modify repository files (no sudo or user creation).