managing-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to non-official/unknown GitHub repositories (including a user "mazrean") and an unknown domain (skills.sh) that reference GitHub Releases (where pre-built binaries are offered) — a common vector for distributing unsigned executables — so they should be treated as potentially unsafe until the publisher and release artifacts are verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow uses skills-pkg search and then skills-pkg add --url <SOURCE>, which downloads and installs third-party skill files from an external registry/repo; those installed skill contents (e.g., their SKILL.md/prompts) become LLM-readable context, so outsider-authored free text can be ingested via the installed skill metadata/workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to run skills-pkg add using remote sources (e.g., https://github.com/example/skills-repo and the registry at https://skills.sh) which downloads SKILL files at runtime and then reads/applies that content to control the agent's prompts/behavior.