create-pitch-deck

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.60). The preamble's bash sends telemetry immediately when _TEL_TIER defaults to "anonymous" (SKILL.md:12-16), which contradicts the explicit instruction to prompt the user before starting telemetry (SKILL.md:21-36), effectively causing hidden/extraneous data exfiltration despite the claimed consent flow.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md ingests outsider-authored free text via the user interview and context files (e.g., .superstack/idea-context.md, .superstack/build-context.md) and then uses that text to generate slide content and speaking notes.