ohou-today-deal

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill fetches public product deal pages from ohou.se, which contain third-party merchant titles and descriptions ingested via HTTP and parsed into JSON.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill executes npx -y @nomadamas/k-skill@0 to fetch instructions and execute code from an external npm package, creating an unverifiable runtime external dependency under weak/unknown provenance (high tier).