rightcode-find-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — SKILL.md explicitly instructs the agent to query and present results from the public skills registry (https://skills.sh/) and public GitHub repositories via commands like "npx skills find" and "npx skills add", which requires ingesting untrusted, user-published third‑party content that could contain instructions influencing subsequent actions.