developing-genkit-dart

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The SKILL.md explicitly instructs users to run "curl -sL cli.genkit.dev | bash", which downloads and immediately executes a shell script fetched from the remote host cli.genkit.dev.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Genkit Dart’s agent HTTP runtime (router.post('/api/$path', shelfHandler(agent.action)) and .../getSnapshot, .../abort) ingests outsider-authored request body text (the user’s chat.send(text: ...) / detach payload) directly into the agent’s turn.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installation step executes remote code via curl -sL cli.genkit.dev | bash, which fetches and runs a script from cli.genkit.dev at install/runtime, creating a high-risk external runtime dependency.