agent-skill-stack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). SKILL.md’s required workflow repeatedly reads/chooses other Skills’ repository files (SKILL.md and scripts) during search/verification, and those third-party READMEs/instructions are treated as untrusted; those full-file texts can be ingested into the agent’s LLM context for instruction-following/evaluation, creating an outsider-authored free-text injection path.