skill-comply

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally executes shell commands and feeds local file contents to an external LLM CLI, which creates clear remote code execution and data-exfiltration vectors (model-sourced setup_commands executed locally and arbitrary prompt payloads sent to "claude").

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). scripts/classifier.py builds a classifier prompt containing the full trace’s free-text fields (event.input/output from claude tool_use/tool_result) and sends it to claude via the “classifier.md” runtime path, so any outsider-written content that gets into the tool call inputs/outputs can be ingested without prior selection.