codacy-analysis-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly fetches remote, user-provided configuration from third-party Codacy repositories (e.g., via "codacy-analysis init --remote " and "init --default" which uses the public Codacy API), and those fetched configs are parsed and used to decide which tools, patterns, and analysis actions to run, so untrusted remote content can influence agent behavior.