twombly

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill's only action is running the vendor's own unpinned npx twombly@latest guide and following whatever it returns, which hands the agent instructions the user cannot review in advance, but there is no sign of malicious intent.