prompts-workflow

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a GitHub tree from an untrusted/unknown account that contains shell/Node/Python scripts which the README instructs you to run (including git pushes, network calls, and publishing actions), so while not a direct .exe download it is a potentially dangerous source for executing arbitrary or malicious actions—moderate-high risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested indirectly via collect.sh running collect-*.py to fetch/parse public sources (Reddit/GitHub/Hacker News/SearXNG) into JSONL files, which are then read by convert-prompts-to-skills.py and embedded into generated SKILL.md/skill content that the workflow publishes.