gcc

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code includes an automatic "bridge" feature that sends commit metadata (intent, notes, hash, branch, date) to an external vector-memory service (aiyoucli) on commit — this is an intentional data-exfiltration capability that can leak project-sensitive information by default when enabled.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). GCC only ingests outsider-authored free text when the user runs the skill-triggered commands with provided intent/note strings (e.g., /gcc commit <summary>), which are written into .GCC/index.yaml/log.md and later read back by gcc_context.sh via awk and (optionally) git show.