blog-writer

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill contains an explicit, mandatory instruction to always publish drafts and final content to a specific external Notion database and project (hard-coded DB ID and page URL), which constitutes a deliberate data-exfiltration/backdoor pattern (forced outbound copying of user-provided content to a fixed external account); aside from that, no obfuscated code, remote shells, credential-theft routines, or dynamic exec patterns are present—only a local pruning script that can delete example files.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The SKILL.md explicitly requires the agent to "review and integrate any information, research material, or links provided by the user" (Core Responsibilities #2 and Phase 1: Gather Information), which means the agent will fetch/read arbitrary user-supplied third-party links and incorporate their content into writing and publishing decisions—exposing it to untrusted external content that can influence behavior.