drizzle-migration-conflict

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Three GitHub Gist links point to personal/community scripts (not official vendor releases) that can contain executable or destructive commands and therefore are a suspicious source for downloads/execution; the other links are official docs or project discussions and are low risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow runs the vendored scripts/check_drizzle_migrations.py, which ingests and parses _journal.json, snapshot.json, and other migration .json/.sql/text files from the repository to detect structural conflicts, and those files can contain outsider-authored text via PR commits/queue-fed changes.