deps

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's required workflow (SKILL.md Step 3 and references/library-update-ratchet.md) explicitly directs the agent to "research release notes / CHANGELOG / migration guide / release notes" on external package pages and runs vulnerability tooling (e.g., govulncheck, npm audit, pip-audit) that query public vulnerability databases, so the agent must fetch and interpret open/public third‑party content which can directly change update/commit/rollback actions.