plan-devex-review

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains deliberate data-sharing and remote-review actions (codex exec, telemetry/brain-sync, and calls to local helper binaries) that can exfiltrate repository/plan content to external services and enable remote execution paths if those tools are compromised.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In /plan-devex-review, the skill ingests the repository plan content (from the host-provided plan file / branch diff) and passes it verbatim into the “outside voice” prompt via codex exec, so outsider-authored text in that plan file can be read at runtime.