skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads outsider-authored free text because npx skills add/use/find can ingest and install SKILL.md (YAML frontmatter + body) from arbitrary git sources/URLs, and that content is directly available to the agents at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI fetches SKILL.md content from remote sources at runtime (e.g., https://skills.sh and repository shorthands like vercel-labs/agent-skills and owner/repo@some-skill) and those fetched SKILL.md files are directly used as agent prompts, so remote content can control agent instructions.