shunk031-doc-slop-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow ingests the exact “draft” text provided by the user/workflow (via read_documents reading file paths or stdin), then sends that untrusted document text directly into the model judge prompt (build_judge_prompt → runner.invoke_codex), so outsider-authored free text can be posted/piped into the gate without selecting a specific item.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill instructs users to export DOC_SLOP_REVIEW_SANDBOX=danger-full-access to relax sandboxing (a direct bypass of security restrictions) and also runs tools that download packages at first run, which together present a moderate risk of compromising the host environment.