configure-ecc

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Step 0 explicitly clones a public GitHub repository (https://github.com/affaan-m/everything-claude-code.git) and subsequent steps require reading and acting on SKILL.md and other files from that clone (verifying, copying, and editing them), meaning untrusted third‑party content from the open web is ingested and can directly influence the agent's installation and modification actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs "git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code" at runtime to fetch SKILL.md and other files that are then copied into the agent's skills/rules (which directly control agent prompts/instructions) and are treated as a required dependency, so the external URL is a high-risk runtime dependency.