managing-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow supports installing/updating skills from outsider-provided URLs (e.g., GitHub subdirectories or .skill zips), which at runtime are fetched/downloaded and their README/SKILL.md text is read/validated by the agent (indirect prompt injection via downloaded repository content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install/update steps perform runtime fetch-and-execute operations (e.g., git clone https://github.com/user/repo and curl -L -o /tmp/skill-$$.zip "https://example.com/skills/my-skill.skill" followed by unzip and pip install), so those URLs are runtime dependencies that can deliver code or prompts controlling the agent.