github-code-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md:38-55 describes using the built-in GitHub MCP to fetch and read “most relevant files” from arbitrary GitHub repositories (public/outsider-authored code text) via github-mcp-server-get_file_contents, which would be ingested into the agent’s LLM context as external reference material.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly uses the built-in GitHub MCP to fetch remote repository file contents at runtime (github-mcp-server-get_file_contents owner: "example-org" repo: "example-repo" path: "src/retry.ts"), and those fetched files are injected into the agent's context as reference material — meaning external content can directly influence prompts and behavior.