@6942/starchild-quests

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The document includes a high-risk supply-chain / remote-execution pattern that auto-installs and runs third‑party skills without explicit user confirmation, plus an instruction to schedule HTTP calls (curl) to a local endpoint that could be repurposed for covert triggers — together these enable execution of untrusted code and potential abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow for “weekly_install_run_skill” ingests outsider-authored free text via search_skills(query, auto_install=true) (search results/community skills), then runs the installed skill exports based on that selection.