skills-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs npx skills find and then fetches skills.sh pages for the top 3–6 candidates, which are community-published skill descriptions the agent must actively select and retrieve, so this is low risk rather than medium.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill manages AI-agent skill directories (install, move, delete within user and project scopes) without requesting sudo, creating accounts, or touching system files, services, or SSH config, though its global installs with -y and --force flags add some state-change risk.