skill-reviewer

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The prompt-injection fixture (evals/fixtures/prompt-injection/SKILL.md) contains explicit instructions to run a shell, print environment variables (exfiltrate secrets), and fetch an external URL — a direct credential-exfiltration/backdoor attempt.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow calls review_skill_package and then applies a semantic rubric to the returned “target content” (outsider-authored package text), which is ingested into the agent’s LLM context for analysis—i.e., indirect prompt-injection risk from the reviewed package’s free-form Markdown.