btx

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs using the btx CLI to clone or update external repositories (e.g., GitHub owner/repo, HTTPS/SSH URLs) and then directs the agent to parse and explore the code at that path, which exposes it to untrusted, user-generated third-party content that could contain instructions influencing actions.