scan-assets

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These are Google Drive / googleusercontent download and preview URLs — personal file-hosting links that can be (and in this skill are used to) deliver arbitrary binaries and to bypass browser virus-interstitials, so they are high-risk sources for malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s runtime workflow only ingests outsider-authored free text when it downloads and transcribes video bytes from the Google Drive “publish queue” (e.g., auto-rename transcript from the first 45 seconds) after listing a folder/queue that an external user could potentially poison, without requiring pre-selection of a specific item by the attacker.