unsplash-image-search-download

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a legitimate Unsplash search-and-download tool, but its image download request also sends the user's Unsplash Client-ID to whatever host the API's download URL points to, which exceeds what the task needs without any malicious intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs an Unsplash API search for a user-supplied query and prints the selected result's photographer name and username, which outsiders control, so the agent must actively search to surface this outsider-authored text, making it low risk.