repo-ingest

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are third‑party GitHub repository links (individual/user projects and one placeholder org) which are not official vendor pages — while GitHub is common for legitimate code, unvetted/small or unknown repos can host malicious code or binary releases, so they should be treated as moderately suspicious and carefully reviewed before cloning or executing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow clones/fetches external repositories at runtime (e.g., git clone --depth 1 {url} /tmp/repo-ingest/{name}) and then reads their README/docs to extract patterns, so outsider-authored free text from those repos can be ingested into the agent’s LLM context during Step 2/3.