library

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly prompts to replace secret placeholders (e.g., {{SVGMAKER_API_KEY}}/{{CONTEXT7_API_KEY}}) by asking the user for actual API keys and writing them into config (~/.claude.json / MCP entries), which requires the agent to receive and embed secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Many are GitHub source/raw URLs and third‑party MCP endpoints (some from unknown or personal orgs) and include instructions to clone/run scripts and npx packages— legitimate development artifacts but potentially able to deliver and execute code, so they are moderately suspicious unless you trust the specific repos and domains.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository intentionally implements persistent auto-sync (launchd/systemd/Task Scheduler) and symlinking, automatic git clone/pull/copy flows that fetch and install arbitrary repository content, runs external packages via npx (stdio MCPs), and reads/writes ~/.claude.json (including resolving/storing API keys) — collectively these are high-risk supply‑chain, remote‑code‑execution, credential‑exposure and potential data‑exfiltration primitives that could be abused as a backdoor.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime path /library use (and /library sync*) clones/fetches outsider-authored GitHub sources listed in library.yaml (e.g., source: https://github.com/.../SKILL.md), then copies the fetched parent directory into the agent’s session context as readable SKILL.md/AGENT.md/prompt text, enabling indirect prompt injection via that outsider content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches GitHub sources at runtime (via git clone/git pull and the /library use or /library load flows) — for example https://github.com/cskwork/claude-minimal-plugin/blob/main/skills/agent-browser/SKILL.md — and the fetched SKILL.md content is injected into the session as active agent instructions, so this external URL is used at runtime and directly controls prompts/instructions.