agent-creator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly allows subagents to use web-fetching tools (see references/subagents.md "Subagents can use ... WebSearch, WebFetch") and the error-handling guidance (references/error-handling-and-recovery.md) instructs agents to "Attempt to fetch latest API documentation from web," so agents are expected to read and act on arbitrary public web content that could carry injected instructions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The prompt enables autonomous subagents with tools like Bash/Write/Edit and even a 'bypassPermissions' permissionMode, and instructs saving and running agents from user/project paths and background execution — while it doesn't explicitly tell the agent to use sudo or create accounts, it provisions powerful capabilities that could be used to modify system state or escalate privileges.