repo-skill-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly resolves and copies upstream skill content from public GitHub repositories or skills.sh URLs as part of its required workflow (see SKILL.md steps 1–2), meaning it ingests untrusted, user-provided repository content that can materially change agent behavior when installed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill explicitly fetches upstream skill sources at runtime (e.g., GitHub repo URLs like https://github.com/... or git@github.com:org/repo.git and arbitrary skills.sh URLs), and the fetched skill files are installed into .agents/skills where they can directly define agent prompts or include executable code.