yc-batch-evaluator

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). Mostly a legitimate investor research automation workflow, but it explicitly instructs retrieving founders' personal emails (Apollo "reveal_personal_emails": true) and aggregating/sharing scraped personal data in a Google Sheet — a clear deliberate PII-exfiltration pattern that could be abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). At runtime the skill scrapes outsider-authored free text from public YC pages and company websites via scrapegraph (Step 1/3a/3b), then injects that extracted prose into the agent’s LLM context for downstream calls (e.g., Perplexity prompt content and row compilation).