skill-install-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill 安装管理器在步骤①/②/③/⑤中会读取可由用户指定的技能列表文件（包括 ./skill-list.md 等任意路径，未指定时也会读取当前工作目录/内置列表），并在推理与后续版本检查时把该文件中的 Origin URL 与技能条目作为可读文本输入来决定安装/降级流程。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly fetches and executes remote repositories at runtime (via npx/git and direct GitHub API/raw content fetches) — for example it runs installs from https://github.com/MarecGents/marec-agent-skills, uses git@github.com:MarecGents/marec-agent-skills.git, queries https://api.github.com/repos/{owner}/{repo}/commits?per_page=1 and downloads files from https://raw.githubusercontent.com/{owner}/{repo}/{branch}/{filepath}, which results in remote code/content being retrieved and executed as part of the runtime workflow.