audit-clerk-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s required workflow ingests outsider-authored free text by cloning the public Clerk CLI repository at runtime (public web content) and then reading packages/cli-core/src/commands/** and related files into the agent’s LLM context for inventory/diffing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md explicitly instructs cloning the remote repository at runtime ("git clone --depth 1 https://github.com/clerk/cli.git clerk-cli-source"), which would fetch source files that the agent ingests to build its command inventory and thus directly controls agent prompts/behavior.