markedit-tools

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow for installing/upgrading extensions downloads JavaScript from GitHub (either a user-supplied .js URL or a constructed GitHub repo/releases URL), and that fetched free-form page/file content is then ingested into the agent context as readable text (i.e., outsider-authored content from public web sources).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and installs remote JavaScript extension files at runtime (e.g. https://github.com/MarkEdit-app/extension-name/blob/main/dist/extension-name-kebab-cased.js?raw=true and fallback https://github.com/MarkEdit-app/extension-name/releases/download/{tag}/extension-name-kebab-cased.js), which are executed by MarkEdit and therefore constitute a runtime external dependency that can execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill directs the agent to perform filesystem changes including moving an .app into /Applications (a system-wide directory that can require elevated privileges) and other on-machine actions like installing/updating apps and extensions, so it instructs modifying the host system state even though it doesn't explicitly ask for sudo or create users.