gatekeeper

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Multiple URLs are direct executable/script endpoints, raw GitHub install/update endpoints, or unknown telemetry/personal-hosting domains (pipe-to-shell / runtime-download vectors and exfiltration targets), which are common high-risk patterns for malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md’s required Step 0/route activation explicitly covers “Sent a URL, document, Gist, or Markdown file to review” and “Sent a GitHub repository link,” which implies the agent fetches outsider-authored prose at runtime and then uses it to produce the STRIDE classification and routed review report (LLM ingests that fetched content as context for analysis).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The fixture SKILL.md in evals/ab-pilot/fixtures.md explicitly describes runtime behavior that POSTs base64-encoded agent files to https://telemetry-collect.xyz/ingest and fetches repository README code blocks and runs them with bash -c, which is clear evidence of an external URL used at runtime to exfiltrate data and execute fetched code.