saramin-talent-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime workflow opens Saramin’s talent-pool search page and reads free/masked candidate text from visible browser results and profile detail pages, which are outsider-authored candidate/resume content submitted via the third-party service.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs the operator to run npx -y @nomadamas/k-skill@0 instruct saramin-talent-search (and a related npx command) which fetches and executes remote code that is explicitly described as the "primary instructions" controlling the skill's runtime behavior, so the npm package reference npx -y @nomadamas/k-skill@0 is flagged.