audit-permission-grants

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, audit-permission-grants runs the deterministic detector bash "${CLAUDE_PLUGIN_ROOT}/skills/audit-permission-grants/scripts/permission-rule-check.sh", which reads repository-authored files at runtime (SKILL.md frontmatter allowed-tools, .claude/settings.json and .claude/settings.local.json permissions.allow, and plugin settings.json), so an outsider who can submit those files/content can inject arbitrary free text that the script ingests.