sourcebot

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required workflow for “sourcebot” calls list_repos/search_code and then get_file_source to fetch and ingest file contents from externally authored GitHub repositories, which are outsider-authored free text (code).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill mandates runtime use of the Sourcebot tools (list_repos, search_code, get_file_source) to fetch repository contents which can directly control prompts — e.g., it fetches from repo IDs like "Effect-TS/effect" and "vercel/ai" (seen in SKILL.md:3 and SKILL.md:44,54), so external repo content is a required runtime dependency.