sourcerer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow can clone and read outsider-authored repository content from user-provided URLs or package/library names (Step 2 + Step 3), which is then ingested as readable source/docs text into the agent’s LLM context; this includes arbitrary third-party repo files that may contain prompt-injection-like free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly clones and fetches git repositories at runtime (e.g., user-provided URLs like https://github.com/owner/repo or git@github.com:owner/repo.git) into ~/.sourcerer/repos and then uses that repository source to drive model reasoning and answers, meaning remote repo content can directly control prompts and execution.