dependency-scanning

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill ingests outsider-authored free text by reading GitHub repository content/Dependabot graph output at runtime (e.g., parsing dependency manifests/lockfiles from the scanned branch and consuming dependabot graph JSON), which an outsider can poison via PR commits to the repository.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime installation commands that fetch and install the Dependabot CLI (e.g., via github.com/dependabot/cli/cmd/dependabot@latest and by querying https://api.github.com/repos/dependabot/cli/releases/latest then downloading the release tarball from https://github.com/dependabot/cli/releases/download/${VERSION}/dependabot-${VERSION}-${PLATFORM}-${ARCH}.tar.gz), which would retrieve and install/execute remote code for the Post-Commit Safety Net use case.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill includes installation steps that move a binary into /usr/local/bin (and installs system-wide), which modifies system-level files and effectively requires elevated privileges — a behavior that can change the machine's state.