copier

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Copier’s required runtime workflow reads and renders template contents (e.g., copier.yml, .jinja files, and _tasks/migration definitions) from the specified Git template source, which can include outsider-authored free text when the template repo is user-supplied.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's docs (e.g. references/cli-api.md) show runtime use of remote template sources like "gh:org/template", "gl:org/template", and "git+https://example.com/t.git" which Copier will fetch at runtime and whose repo files (copier.yml, _tasks, migrations, _jinja_extensions) can control prompts and execute arbitrary shell when run with --trust.