od-contribute

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly tells the agent to "surface the printed install / auth hint verbatim" (which could contain tokens) and to substitute an environment variable ($OD_DISCORD_INVITE) directly into rendered PR bodies, requiring the LLM to output verbatim secret-like values.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). Two URLs point to direct executable/archive downloads (a raw .sh install script and a GitHub tarball of a repo branch) which are high-risk to curl|bash or extract from untrusted sources — even if they reference a project repo, piping remote shell scripts or auto-extracting branch tarballs can be abused to distribute malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 3d.4, the runtime calls gh search issues using keywords derived from the user-provided bug description, and the resulting issue titles/URLs are read and surfaced to the user during the dedupe prompt.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs a runtime fetch of the repository's issue template via the gh API (gh api "repos/${TARGET_REPO}/contents/.github/ISSUE_TEMPLATE/bug-report.yml" ...) and decodes it to /tmp/od-bug-report.yml so the fetched YAML schema is used to drive the user prompts for the bug-report flow, which directly lets remote repo content control agent prompts.