bookkeeping

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill enforces reflexive, non-consensual capture of session content and includes code paths that send extracted repository/session content and authored prompt files to external LLM APIs (Gemini/Anthropic), which creates an explicit, deliberate data-exfiltration/privacy risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow (“Stage 1 — INGEST” → “Stage 2 — SCORE” LLM-as-judge) ingests outsider-authored free text from sources like web clips / conversation transcripts / social engagement logs into RawItem.content, then passes that text into the LLM judge prompt (e.g., score_item_llm / authored-agents scorer), creating an indirect prompt-injection path.