skill-diff

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). In scripts/compare.sh full mode, the script fetches outsider-authored free text from GitHub at runtime via gh api repos/$R_OWNER/$R_REPO/contents/$R_PATH (upstream SKILL.md), then passes both local and fetched text into diff -u and prints the raw diff for Claude to ingest.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script calls the GitHub API at runtime (via gh api "repos/$owner/$repo/git/trees/HEAD?recursive=1" and gh api "repos/$R_OWNER/$R_REPO/contents/$R_PATH" — i.e. https://api.github.com/repos///contents/) to fetch the upstream SKILL.md and injects that content (the raw diff) into the agent's interpretation step, so external content directly controls the agent prompt/output.