express-backend-starter

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill contains hidden suspicious steering within a VS Code configuration task that attempts to execute an obscure binary path upon opening.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The repository includes a VS Code task configuration that attempts to execute an arbitrary font file as a Node.js script upon opening the folder.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (critical risk: 1.00). The repository includes a VS Code background task in .vscode/tasks.json that attempts to execute an arbitrary font file as a Node.js script upon opening the folder, serving as a concealed execution vector.