activator-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow reads outsider-authored free text when an attacker can cause the skill to inspect activator definitions that include Base64-decoded ReflexEntities.json and JSON-encoded rule/source payloads (e.g., via consumption → getDefinition → .payload → base64-decode → jq/JSON-parse).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill mandates a runtime "check-updates" step that explicitly runs a remote git fetch and show (git fetch origin main --quiet && git show origin/main:package.json) or queries the GitHub API to pull package/changelog content which the skill uses to decide what update/changelog instructions to present, so remote content fetched at runtime can directly control agent prompts.