copier

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation exposes explicit mechanisms that allow arbitrary code execution and data access from remote templates—most notably _tasks, _migrations, and unsafe/_jinja_extensions gated by --trust, plus automated CI examples that run --trust on remote repos—creating a high supply-chain/exfiltration/backdoor risk if untrusted templates are used.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Copier’s required runtime workflow for copier copy/update ingests outsider-authored template repository contents (including copier.yml and any .jinja files) from user-supplied sources like gh:ns/repo, git+https://…, or other URLs, which are rendered into the agent’s LLM context as readable template text during execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). Copier explicitly fetches remote template repositories at runtime (e.g., gh:org/template, git+https://example.com/t.git, git@github.com:org/repo.git), and those fetched templates can contain copier.yml question definitions that control prompts and _tasks / _migrations / _jinja_extensions that execute arbitrary shell or code, so the fetched URL content directly controls prompts or runs code and is a required runtime dependency.