se2-dev-game-code

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). At runtime, the skill’s required workflows run shell/Python tooling that parses and reads decompiled C# source files from Data/Decompiled/ (game-code content), which is outsider-authored relative to the operator and becomes readable text output/derived data for the agent (e.g., via search_game_code.py reading/formatting signatures and locations).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). common_posix.sh installs the "uv" tool at runtime by piping a remote installer script to sh (curl -LsSf https://astral.sh/uv/install.sh | … sh and wget -qO- https://astral.sh/uv/install.sh | … sh), which fetches and executes remote code required for the skill.