skills-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes installing third-party Skills via npx skills add <owner/repo@skill> -y, which at runtime will fetch and ingest outsider-authored repository content (e.g., the Skill’s own SKILL.md/scripts) into the agent’s LLM context, creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The document instructs running npx to fetch and install third‑party skill code at runtime (e.g., npx skills add <owner/repo@skill> -y), which downloads and executes external repository code that can control agent prompts and has full privileges.