set-custom-rules

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md workflow explicitly tells the agent to "Run npx -y cc-safety-net --custom-rules-doc and use that schema documentation as the source of truth" (step 1) and then requires the agent to "Convert the request into valid Safety Net JSON using the schema documentation" (step 4), meaning the agent will ingest and act on documentation fetched from a public third-party package (npm) which could contain untrusted content that materially affects behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes runtime package execution via "npx -y cc-safety-net" (used in steps 1 and 8) which fetches and runs remote code and provides the schema/docs that directly influence prompt-to-config generation, so this external dependency controls agent behavior and executes code at runtime.