deslop-duplication-audit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill points users to a GitHub Releases page for precompiled platform binaries from a third‑party account (Nimblesite), which is a direct executable distribution vector and should be treated as potentially risky unless the maintainer is verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Source text from outsiders is only ingested as unified diff content when supplied by the workflow user (via the required --diff, --diff-file, or --touched-files CLI flags) and then parsed by parseUnifiedDiff/range mapping before formatting output.