oncall-investigator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly ingests user-generated Slack content as part of its required workflow—using _slack_read_channel, _slack_read_thread and _slack_search_public/_slack_search_public_and_private—to drive investigation steps and posting decisions, which exposes the agent to untrusted third-party input that can materially influence actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to load SKILL.md files from https://github.com/SpotDraft/oncall-investigator-skills/tree/master and treat those files as first-class debugging workflows, meaning fetched content would directly control the agent's prompts/instructions.