multica-skill-importing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can be ingested when the runtime imports a skill from an external URL (e.g., GitHub/skills.sh/clawhub.ai); the server fetches that repository/page content and stores it as the skill’s content/files, which then become part of the agent’s LLM context when the skill is executed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The import flow accepts and fetches external skill URLs (e.g., https://github.com/owner/repo, https://skills.sh/owner/repo/skill, clawhub.ai/owner/skill) at import time to populate a skill's SKILL.md and files which directly become the skill's prompts/instructions used by agents, so these external URLs are runtime dependencies that control agent behavior.