live-dependency-resolver

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The companion-check asks the agent to run local filesystem commands (ls ~/.claude/skills/ ...), compare results to recommended_skills, and offer installing missing skills—an explicit instruction to inspect/modify the host environment that is unrelated to live dependency resolution and therefore constitutes an out-of-scope, potentially deceptive directive.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — SKILL.md explicitly instructs the agent to query and parse live public package registries (e.g., registry.npmjs.org, pypi.org, crates.io, proxy.golang.org, rubygems.org) via CLI or curl and use that raw output to decide versions and installation actions, meaning untrusted third-party content is read and can materially influence tool use/decisions.