sharingan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In Phase 1 (SCANS) the workflow ingests outsider-authored free text from any GitHub repo the user supplies by calling gh api repos/{owner}/{repo}/git/trees/... and then fetching and parsing SKILL.md file contents (fetchFileContent → sanitize(decoded)), which are later processed in Phase 2 by the LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches GitHub repository contents at runtime (e.g., https://github.com/anthropics/skills) via the GitHub CLI (gh api) and uses the fetched SKILL.md content as input to LLM-based analysis/generation, which means external repo content can directly influence prompts and generated instructions.