keepflash

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs include an external GitHub repository (a remote code/supply-chain source from an untrusted/unknown username) and a presigned storage URL (a non-vendor file-hosting endpoint with a secret query) which are common vectors for distributing malicious binaries or secrets.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text from user-controlled KeepFlash search/query and then ingests untrusted note content/snippets returned by the MCP tools (context, search, read) as contextText/notes[] at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bootstrap (scripts/bootstrap.mjs) fetches and installs runtime files from the Git repository URL "https://github.com/dante-is-shipping/keepflash-skills.git" at every activation, and the retrieved SKILL.md and runtime scripts are treated as the authoritative runtime instructions that directly control agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill fetches and runs an external runtime from GitHub and instructs the agent to "follow those runtime instructions as the authoritative workflow," which effectively permits arbitrary remote code execution that can modify system files, request elevated privileges, or create users.