scrape

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill prompt contains explicit instructions to modify the repository and run local configuration (git commits, rm, gstack-config, touch files, etc.) which are side-effectful and unrelated to the /scrape read-only purpose, so these are deceptive/out-of-scope instructions (prompt injection).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow can ingest outsider-authored free text via the prototype path’s runtime page extraction primitives (e.g., $B goto <url> followed by $B snapshot --text / $B html), which read arbitrary web page content (public web content authored by others) into the agent’s LLM context for parsing.