openchoreo-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow fetches external community module READMEs from GitHub via URLs like https://github.com/openchoreo/community-modules/tree/main/<module-name>, which is an arbitrary/user-supplied selection of repository pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill contains an operational script (scripts/fetch-page.sh) that dynamically downloads configuration and content from githubusercontent.com and openchoreo.dev at runtime, representing a common unofficial remote dependency.