iblai-vibe-ops-upgrade

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md’s required workflow runs npx skills add iblai/vibe --all and curl -sL https://raw.githubusercontent.com/iblai/vibe/.../CHANGELOG.md, which fetches outsider-authored free text from public web sources at runtime and can be ingested into the agent/LLM context via the executed tooling.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs package installer commands that fetch and execute remote code at runtime (e.g., "pnpm update @iblai/iblai-js@latest" / "npm install @iblai/iblai-js@latest" at SKILL.md:36-41 and "npx skills add iblai/vibe --all" at SKILL.md:66), which are runtime external dependencies that will execute remote content.