agent-interop

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Most links are official docs and repos, but the list includes a direct GitHub releases download URL (a binary/tarball pattern, shown here as a templated/truncated link) which is a direct executable distribution vector and therefore a higher-risk download source.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text can reach the LLM at runtime via MCP “resources”/content responses (e.g., resources/read and tool outputs) that the model receives as untrusted input, and MCP also allows user-triggered prompt mechanisms whose parameters may include outsider text; the skill docs describe these primitives but do not impose a “no free-text ingestion” boundary at the wire level.