setup

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The setup content contains multiple intentional patterns that create a privileged remote-execution and supply-chain exfiltration vector: it checks out and runs an external plugin (unpinned main branch) with scripts (knowledge-gate), provisions dynamic secret-bearing config files (.mcp.json) that are sent to external MCP endpoints, grants broad runtime permissions (Bash/Read/Write/Agent/Skill) to model-action tooling, and instructs adding persistent CLI execute permissions to project-level settings — together these enable a backdoor/supply‑chain exfiltration and remote‑code execution risk if the plugin or model actions are compromised.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow templates (e.g., .github/workflows/batch-refine.yml, mark-evidence.yml, and curate-report.yml) configure MCP servers for github/slack/notion and explicitly instruct the agent to read PR comments, Evidence Bundle Manifests, and external Slack/Notion content (user-generated/untrusted) and then take actions (classify feedback, create changesets, label PRs), which allows third‑party content to materially influence agent decisions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow checks out and depends on the external git repository "ether-moon/knowledge-distillery" (actions/checkout repository: ether-moon/knowledge-distillery → https://github.com/ether-moon/knowledge-distillery) at runtime and then executes a script from that checkout (the knowledge-gate binary), so remote content is fetched, required, and executed by the skill.