update-skills-from-changelog

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is fetched at runtime from the public elevenlabs-dx repository changelog URL (GitHub-hosted markdown), which is then read and used to drive edits; this changelog content is not authored by the operating user and becomes LLM-readable prose via the fetched markdown file.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches the merged changelog at runtime from the GitHub contents API (gh api "repos/elevenlabs/elevenlabs-dx/contents/fern/docs/pages/changelog/${CHANGELOG_DATE}.md?ref=main") and uses that file's content to drive what edits and PR actions the agent performs, so the external file directly controls agent instructions.