cli-anything-hermes

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow can clone/fetch cli-anything-plugin from GitHub (public web content) when local ../cli-anything-plugin/HARNESS.md is unavailable, and that fetched HARNESS.md/resources are then read and used to guide harness generation—i.e., outsider-authored free text enters the LLM context via the network retrieval path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md explicitly instructs the agent at runtime to clone or download HARNESS.md and related resources from https://github.com/HKUDS/CLI-Anything/tree/main/cli-anything-plugin and then use that content as the "source of truth" for agent behavior, which is a runtime fetch that directly controls prompts/instructions.