synthesis-skills-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly pulls/clones and reads SKILL.md files from source repositories (e.g., the public "synthesis-skills" repo) and the install/update/merge workflows require the agent to read and act on that third-party repo content, so untrusted public skill files could influence agent decisions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill manager explicitly pulls/clones SKILL.md from remote repos at runtime (e.g., github.com/synthesisengineering/synthesis-skills as shown in .source.json) and uses those fetched skill files as agent instructions, so that external repository content directly controls agent behavior.