sync-mattpocock

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—at runtime the workflow fetches outsider-authored free text from public GitHub content (mattpocock/skills SKILL.md via curl/raw URLs and compares/audits via GitHub API), which the agent then reads and uses for classification/translation, thereby feeding that text into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runtime fetches upstream skill files and metadata (which directly determine agent prompts/instructions) from GitHub — e.g. it curl-fetches SKILL.md via "https://raw.githubusercontent.com/mattpocock/skills/main/skills///SKILL.md" and GitHub API endpoints like "https://api.github.com/repos/mattpocock/skills/git/refs/heads/main", so remote content controls the agent.