office-hours

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt contains explicit, actionable shell/git commands and directives to modify files, run installers, and change project state (e.g., git commits, rm, gstack-config) that directly contradict the skill's stated "HARD GATE" of producing design docs only and not performing any implementation—these are hidden/deceptive instructions that would change repository or environment outside the skill's declared purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains high-risk, deliberate patterns: it automates executing local vendored binaries and remote installers, modifies the repo (git rm/add/commit), and explicitly sends repository/context to external "codex"/agent tooling — creating clear avenues for data exfiltration, supply-chain compromise, and remote code execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup step conditionally downloads and executes the Bun install script at runtime via curl -fsSL "https://bun.sh/install" and then runs it with bash, which fetches and executes remote code that directly affects runtime behavior.