benchmark-context

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user for API keys/credentials and instructs creating/updating memorybench/.env.local with those values, which requires the agent to receive and write secret values verbatim (high exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The three GitHub URLs are potentially risky because the skill explicitly instructs cloning and running code from that third‑party repository (directly downloading and executing external code), while the localhost URLs are local endpoints and not download sources.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow clones and runs the public repository https://github.com/supermemoryai/memorybench at runtime and then uses its components/outputs (including benchmark questions/results) as LLM-readable prose, creating an indirect prompt-injection exposure surface from outsider-authored repo content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly performs a runtime git clone and then runs the fetched project (git clone https://github.com/supermemoryai/memorybench.git ... && bun run ...), so code fetched from https://github.com/supermemoryai/memorybench.git is executed and directly controls the agent's runtime behavior.