url-to-code

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly instructs loading user-context (including saved tokens) and running preflight scripts, exposes a locally-hosted preview on 0.0.0.0 while instructing the tool to hide internal URLs, and the agent policy allows implicit invocation — together these create clear avenues for credential access/exfiltration and hidden/unauthorized invocation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—runtime steps “Open the source URL” and “Capture the source page carefully” require the agent to read arbitrary outsider-authored web page text/DOM content from the target URL into the LLM context, which can include prompt-injection strings.