i4h-workflow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime path clones public GitHub content (git clone https://github.com/isaac-for-healthcare/i4h-workflows "$ROOT") and then runs workflows/agentic/policy/run.sh --list-envs, so the agent can ingest free-form text originating from an outsider-controlled repository at runtime (potential indirect prompt injection via script/output).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime setup explicitly performs "git clone https://github.com/isaac-for-healthcare/i4h-workflows" (SKILL.md) to fetch repository code that may then be executed (run.sh), so remote content is fetched and used as a required dependency.