audit-website

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains high-risk, potentially abusive behaviors: it instructs probing local directories, environment variables and “references in memory” to discover targets, encourages piping outputs to external LLMs, endorses curl|bash and PowerShell iex installers, and — critically — mandates autonomous, non-consensual code/content edits via spawned subagents with “Do not ask”/“Don't stop early” directives, which together enable data exposure and unauthorized modifications (possible exfiltration and supply-chain abuse).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflow instructs the agent to crawl and fetch arbitrary public websites (e.g., "squirrel audit https://example.com", "The audit crawls the website, analyzes each page") and to act on findings (spawn subagents and apply fixes with "Do not ask for confirmation"), so it ingests untrusted third‑party web content that can influence tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's prerequisites instruct running remote installers that fetch-and-execute code (curl -fsSL https://squirrelscan.com/install | bash and PowerShell irm https://squirrelscan.com/install.ps1 | iex), which are required to obtain the squirrel CLI the skill depends on, so these URLs can execute remote code at setup time.