homebrew-publish

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Runtime path: the skill ingests outsider-authored free text from the project’s source tarball/prebuilt asset by fetching remote URLs (e.g., curl -L <url> | shasum -a 256 and brew create <url-to-tarball>), which causes the agent to read and process the tarball’s contents (e.g., build scripts, metadata) that are authored by parties other than the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs fetching and building remote release archives (e.g. "https://github.com/OWNER/yourtool/archive/refs/tags/v1.2.3.tar.gz") via commands like brew create and brew install --build-from-source (and to curl remote tarballs to compute sha256), which will download and cause build/install steps to execute code from those external URLs at runtime.