dev-marketing-prospector

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). One sentence: The claude.ai links are official, but the presence of an unknown third‑party GitHub repo (Infrasity-Labs/dev-gtm-claude-skills) that instructs zipping/uploading and executing custom skill code is a moderate-to-high risk because it involves running untrusted third‑party code inside your environment.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow requires fetching and ingesting outsider-authored free text from public web sources (e.g., “Google News for the company name + current year” and other third-party articles/directories in Step 3), which the agent then uses to generate the sourced signals and pain points in the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs cloning and running remote code — "git clone https://github.com/Infrasity-Labs/dev-gtm-claude-skills.git" and then launching the skill (claude), which fetches and executes repository code that controls the agent's behavior at runtime.