jentic-api-improve

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow can fetch and ingest outsider-authored free text from a runtime-supplied public URL into the working spec (via python3 -c ... urlretrieve(...)), which is then read/processed by the scoring/LLM pipeline; this creates an indirect prompt-injection surface through the spec content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes the score CLI via npx (npx -y @jentic/api-scorecard-cli ...) which at runtime fetches/executes remote packages and — per the docs — pulls and runs a scoring engine Docker image from ghcr.io, meaning external code (the ghcr.io image and the npm package) is fetched and executed and is a required dependency for scoring.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill explicitly recommends using a "bypassPermissions" mode and pre-approving broad Bash wildcards (allowing many shell commands without prompts), which weakens the agent-hosting platform's permission guard even though the skill does not request sudo, create users, or directly modify system config files.