coding-agent-hardened

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly instructs cloning and fetching arbitrary GitHub repositories and PR refs (see "Review PRs" and "Batch PR Reviews" where it uses git clone/git fetch and runs coding agents in those workdirs), so the agent is expected to read and act on untrusted, user-generated repository and PR content which could carry indirect prompt-injection instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill shows runtime cloning of external repositories (e.g., "git clone https://github.com/user/repo.git $REVIEW_DIR") which the coding agents will read and operate on—meaning fetched repo content can directly drive agent prompts/actions and enable remote code execution in the workspace.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt explicitly encourages running coding agents with sandboxing disabled (--yolo) and an "elevated" host mode and shows examples that install global packages and run arbitrary commands on the host, which strongly encourages actions that can modify or compromise the machine state even though it doesn't directly instruct creating users or editing systemctl/ssh files.