codebase-cleanup-deps-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill involves dependency auditing and vulnerability scanning via APIs like npm audit and CVE registries where descriptions/advisories are ingested, which can include untrusted data.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The referenced URLs in code samples (npm registry, PyPI, Rubygems, Sonatype, and Bundlephobia) are endpoints queried programmatically at runtime by the provided Python and JavaScript scripts for dependency scanning and size analysis, making them operational runtime dependencies.