ship

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly requires staging and pushing all non-gitignored local files (including others' concurrent work), authorizes automatic admin merges without further confirmation, and instructs hiding agent attribution — behaviors that enable data exfiltration, unauthorized changes, and obfuscation of provenance.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The /ship workflow ingests outsider-authored free text via GitHub PR content: when /babysit-pr monitors the PR, it reads PR body/review comments/discussion text authored by non-operating users and feeds that text into the agent’s LLM context for reply/merge gating.