zx

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill reads outsider-authored free text when zx is invoked with --eval, zx << 'EOF' (stdin scripts), or with a https://... remote script URL because those inputs are executed as zx/JS/TS/bbash code at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI explicitly documents that "Scripts starting with https:// are downloaded and executed" (example URL: https://raw.githubusercontent.com/google/zx/refs/heads/main/examples/hello.mjs), which is high-confidence evidence that the skill can fetch remote code at runtime and execute it.