skill-installer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime paths scripts/list-skills.py and the installer scripts call GitHub APIs to fetch directory listings and then download/copy skill repositories from user-specified GitHub repos/paths, meaning outsider-authored text from those repositories can be read/ingested at install time via the fetched SKILL/skill files.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer scripts fetch and install remote GitHub repositories at runtime (e.g., using https://codeload.github.com/{owner}/{repo}/zip/{ref} and the GitHub API URL https://api.github.com/repos/{repo}/contents/{path}?ref={ref}), which will retrieve SKILL.md and arbitrary skill code that can directly control agent behavior when installed.