auto-review-loop-minimax

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow reads AUTO_REVIEW.md (which may contain prior outsider-authored reviewer text) and sends it as “Full research context” / “For round 2+ include the summary of previous review feedback” in the Phase A external-review API call, so the LLM context can include free-form text authored by an external reviewer.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime curl calls to the MiniMax API at "https://api.minimax.io/v1/chat/completions" to fetch reviewer responses that are saved verbatim and used to drive subsequent decisions and code/execution actions, so this external URL directly controls the agent's behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill instructs the agent to read local credentials (~/.claude/settings.json), persist and delete state files, launch/monitor remote SSH experiments, and silently write files without user permission — all actions that modify local or remote machine state and can exfiltrate secrets — but it does not request sudo, create users, or change system-level configuration.