hve-core-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill explicitly clones and reads content from the public GitHub repository (e.g., git clone https://github.com/microsoft/hve-core.git in the "Common Clone Operation" / Methods 1–6 and scripts like agent-copy, collision-detection, upgrade-detection and validate-installation), and it parses collection manifests, package.json and agent files from that external repo to decide which agents/files to copy and how to configure the environment—so untrusted third‑party content can directly influence tool actions and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installer runs runtime git clone commands (e.g., git clone https://github.com/microsoft/hve-core.git and postCreateCommand cloning) to fetch the microsoft/hve-core repository whose files include agents, prompts and instructions that will be loaded into the agent context and thus directly control prompts/instructions, making this an active runtime dependency.