landing-report

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt repeatedly claims the skill is read-only but includes explicit, out‑of‑scope mutation commands (git commits, rm, touch, config changes, auto-running tools and prompts), which are deceptive instructions that alter repo/config state despite the stated purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow calls bun run bin/gstack-next-version which (per its purpose) queries the remote PR/queue state and returns JSON containing outsider-authored PR titles/branches/URLs; that free-form text is then rendered into the LLM context via the dashboard table.