team-foundation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly clones and pulls code from a public GitHub repo (see the install.sh example: git clone https://github.com/marvinrichter/clarc.git and the /team-sync step "Pull latest clarc" -> cd ~/.clarc && git pull), then installs/loads rules and SKILL.md files from those fetched repositories into ~/.claude, meaning untrusted third-party content would be read and could change agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install script clones and then executes remote code (git clone https://github.com/marvinrichter/clarc.git followed by bash "$CLARC_DIR/install.sh") and the repo/private git (git@github.com:yourco/company-clarc.git) contains rules/skills that Claude loads to control prompts, so these runtime fetch+execute steps directly control agent behavior.