starlight-skills-deployment

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs the skills CLI to fetch skill files from a public "well-known-endpoint" (dist/.well-known/skills on a deployed site) so the agent/CLI will retrieve and interpret externally hosted skill Markdown/JSON from arbitrary public URLs, which could contain untrusted instructions affecting agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI example "npx skills add https://your-starlight-site.example.com" indicates the agent will fetch SKILL.md files from a .well-known/skills endpoint at that URL at runtime, and those fetched Markdown skill files directly control agent instructions/prompts.