skill-audit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The GitHub repo is from an unknown account (requires further vetting) and the second URL (http://evil.com?token=) is an explicit HTTP exfiltration-style endpoint, so together they indicate a high-risk/malicious distribution vector.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow is a pre-install audit of a third-party skill’s repository contents (e.g., “Read every referenced script” and “Pattern detection in SKILL.md” from the skill being installed), which means the agent ingests outsider-authored free text from that external repo at runtime (SKILL.md/comments/scripts/README).