run-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). SKILL.md is fetched from an outsider-controlled GitHub repo at runtime (via scripts/fetch-skill.mjs downloading SKILL.md and referenced files from raw.githubusercontent.com), and the workflow then reads that downloaded SKILL.md “in full” and executes its instructions—so the LLM context can receive outsider-authored free text through the remote skill’s instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The fetch-skill script fetches skill files at runtime from GitHub (notably https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/${branch}/${node.path}), and those downloaded SKILL.md/included files directly control the agent's instructions and are required to run the skill.