skill-scout

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Personal GitHub account "shipshitdev" is an unvetted, non-official source that could host releases or executables and therefore represents a higher-risk download origin.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). SKILL.md:80-91 describes performing runtime web/package/GitHub searches and then vetting candidates (reading external pages/repos), which can feed outsider-authored free text into the agent’s LLM context via the “Search External Sources” path.