document-release

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The skill explicitly promises telemetry will never send repo names (SKILL.md:51-53) but earlier it writes the repo basename into an analytics file (SKILL.md:27), a deceptive/hidden data-collection behavior outside the advertised scope.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). This workflow reads documentation files from the current repository (e.g., find ... "*.md" then “Read each documentation file”), which can include outsider-authored free text (issues/PRs/wiki/docs authored by others) and feeds it into the agent’s LLM context for auditing.