sync-local-global-agents-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 该技能在运行时会从“memorix 官方仓库（GitHub raw）”获取并写入 ~/.agents/skills（scripts/sync.ts → refreshMemorixSkills → fetchFromGitHub/fetchTree → writeSkillFiles），这些是外部网页/仓库内容，且其文件内容会以可读文本形式进入本地 skills 目录（间接可被后续 LLM 读取），构成外部自由文本注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The code calls the GitHub Content API at runtime (e.g. https://api.github.com/repos/AVIDS2/memorix/contents/... and downloads files via raw.githubusercontent.com or an alternate raw mirror) to fetch memorix skill files which are written into ~/.agents/skills and therefore directly supply prompt/instruction content to local agents.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). Yes — the skill explicitly directs the agent to modify local filesystem state (create/delete/backup/replace target platforms' skills directories with symlinks, alter AppData paths, and fetch remote content into ~/.agents/skills), actions that change the machine state and can require elevated permissions or break local services.