picoclaw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly supports fetching and ingesting arbitrary public content — e.g., installing skills from GitHub/registries ("picoclaw skills install ..." in SKILL.md and references/skills.md) and configuring web search/fetch tools (references/tools.md) — which the agent is expected to load/read and can materially influence tool selection and behavior, enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs explicitly allow installing skills from a GitHub repo slug (e.g., "picoclaw skills install sipeed/picoclaw-skills/weather"), which at runtime fetches remote repository content (https://github.com/sipeed/picoclaw-skills) that can include skill prompts or executable code that controls agent behavior.