skill-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). SKILL.md explicitly imports arbitrary public repos (via "npx --yes skills add <owner/repo>" and the fallback "git clone https://github.com/<owner/repo>") and then instructs reading and injecting the installed skill file ("skill_content = read(".claude/skills//SKILL.md")") into the agent prompt, which exposes untrusted, user-generated third‑party content that can directly influence agent decisions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's import procedure fetches remote repositories at runtime (e.g., git clone https://github.com/<owner/repo>) and then reads/injects the fetched SKILL.md into the agent prompt, so external content can directly control instructions and is required for the skill to function.