registry-browser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md describes runtime fetching of outsider-authored registry content from public GitHub repositories (e.g., “获取 skills/ 目录列表及每个 SKILL.md 的 frontmatter” and later “获取并展示完整文件”), which would ingest arbitrary free text from other authors into the agent’s LLM context.