verification-before-completion

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill explicitly mandates a mandatory fresh-context Stage 2 review, but later includes a "compaction" hook that injects a prompt telling a resuming agent "RESUME, DON'T RESTART" and to avoid relaunching fresh reviewers, which is a hidden/deceptive override of the stated fresh-context independent audit requirement.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is a personal GitHub repository referenced with explicit instructions to clone and run its internal scripts, which is high-risk because running arbitrary code from an unknown/unvetted account can execute malware or supply-chain attacks.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The SKILL explicitly runs "git clone https://github.com/meisijiya/Skills /tmp/mjs-check" and then executes scripts from that clone (bash /tmp/mjs-check/scripts/...), which fetches remote code at runtime and executes it, directly controlling the agent's verification behavior.