multica-skill-importing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow is multica-skill-importing, which only ingests outsider-authored text when an operator explicitly triggers skill installation by calling POST /api/skills/import with a concrete url or by uploading a local .skill/.zip archive; it does not describe any agent behavior that continuously reads attacker-controlled inbox/chat/feeds/tickets without selecting a specific import target.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The import flow clearly fetches remote skill bundles at runtime (e.g., "github.com/owner/repo" and "https://skills.sh/acme/repo/review-helper"), and the downloaded SKILL.md/supporting files become the skill content that can control agent instructions, so these external URLs are runtime dependencies that supply code/instructions.