synthetic-data-generator

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly provides an "Active Participant Simulator" with step-by-step automation to mass-submit online forms (e.g., Google Forms) and guidance to evade bot detection (human-like delays, submission loops, screenshots as proof), which facilitates deliberate abuse such as survey manipulation or fraudulent submissions; it does not show direct credential theft, backdoors, or obfuscated remote-exec payloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). SKILL.md:40-52 describes an “Online” workflow that navigates to a user-supplied Google Forms URL via chrome-devtools, then uses puppeteer_evaluate to read/identify the form’s question text—this is outsider-authored free text from a public web page that can be ingested into the agent’s LLM context for mapping/answering.