sub-agent-dispatch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). High likelihood: this skill describes dispatching sub-agents via agents-mcp and passing a user-provided prompt string as the full self-contained task description, so the agent context at runtime will include outside-authored free text from the user that the operating user did not author into the skill’s reference material (outsider message content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repo instructs agents to run compose-agentsmd at runtime which fetches rules from "github:metyatech/agent-rules@HEAD/rules/domains/skill/repository.md" (and the agent-rules source "github:metyatech/agent-rules"), and those fetched rules directly control agent instructions, so this is a runtime external dependency that affects prompts.