claude-changelog

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md 的 Phase 1 会在运行时通过 GitHub Releases API（或 fallback 的 raw CHANGELOG.md）获取 release body/CHANGELOG 的文本，这些内容由外部发布方（anthropics/claude-code 的仓库维护者）撰写并会被用于生成报告，从而进入代理的 LLM 上下文。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill runtime fetches external release/changelog content that is injected into the agent context via curl to "https://api.github.com/repos/anthropics/claude-code/releases?per_page=30" and the fallback raw URL "https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md", which directly control the model's input used to generate the changelog report.