finger-frame-ai

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Three URLs are official Google resources (AI Studio, Gemini docs, and a Google Cloud Storage MediaPipe model) and are low-risk, but https://adal.sylph.ai/install.sh is a direct third‑party install.sh (curl | bash) which is a high‑risk delivery method that can distribute malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime path scripts/process.py → scripts/stylize.py calls Gemini with input=[{"type":"text","text": args.prompt}], where --prompt is supplied by the user, but it is not outsider-authored content from any monitored external queue/feed or document store (only the user’s CLI text and first-party default prompt are ingested).