video-ad-specs

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a legitimate ad-spec guide, but its top-level instruction tells the user to install the CLI skill from a different publisher (belt-sh/cli) than the inference-sh source used everywhere else, which is an unexplained source inconsistency that could be a lookalike install destination.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The decisive boundary is the setup-time npx skills add belt-sh/cli path, which installs skill material from a GitHub repository locator; the belt-sh organization is not clearly established as the first-party publisher of the belt CLI, so it is a common/reputable unofficial dependency (medium), while the inference-sh raw GitHub install link is first-party and therefore strong.