skill-sets

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Several URLs point to unrecognized or test hosts (evil.test, untrusted.test), include an HTTP (non‑HTTPS) manifest, or contain malformed/ambiguous patterns (trailing ** / redirect-injection marker) — all are high-risk indicators for distributing untrusted payloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). High: the add workflow fetches outsider-authored free text (HTTPS manifest/sidecar lock bodies) at runtime via fetchManifest()/loadSidecar(), then parses and uses the resulting strings (e.g., text.data and sidecar.text) to generate outputs and error messages that can be included in the agent/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI fetches skill-set manifests from arbitrary HTTPS locations at runtime (see the example URL https://skill-sets.md/sets//.skill-set.json) and then uses the fetched manifest to drive installs (spawning the upstream npx skills tool), so remote-hosted manifest bytes can determine what code the tool will fetch and execute.