skills-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). This skill explicitly installs and loads SKILL.md files from public GitHub repos (e.g., "npx skills add /franklin-skills" and "git clone https://github.com/...") and its "How Discovery Works" section states the agent will load the full SKILL.md body into context on activation, meaning untrusted, user-published third‑party content can directly influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs installing skills from GitHub at runtime (e.g., via "npx skills add /franklin-skills" and "git clone https://github.com//franklin-skills.git"), which will fetch remote SKILL.md files that are then loaded into the agent and directly control prompts/instructions.