addyosmani-quality

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow is installing/invoking a community package from GitHub (public web content) via npx skills add ..., and the agent will then read that skill’s runtime files (outsider-authored text) into its LLM context when executing the installed skill.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's install step uses npx to add the package "addyosmani/web-quality-skills", which fetches and executes code from the upstream GitHub repository https://github.com/addyosmani/web-quality-skills during installation, so it is an external dependency that executes remote code.