ceo-council

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill's persistence actions, writing a pointer line into the user's AGENTS.md/CLAUDE.md and committing files to git without a separate confirmation, alter the user's project files beyond the analysis the user asked for, which fits the medium category under the recall-first override, though the behavior is disclosed and serves the skill's purpose.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill directs the agent to draw portraits "by the visual-grammar skill" at the GitHub locator https://github.com/serejaris/visual-grammar, so that repository's instructions would govern runtime behavior; it is an individual's personal repository, so it is unofficial rather than strong first-party provenance, giving medium under the recall-first override.