html-report-design

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a personal GitHub repository (unknown/individual account) that includes install instructions (npx / copying into ~/.claude/skills/) which would fetch and install code into a local environment — GitHub repos from unknown users that ask you to run install commands can deliver arbitrary code and are therefore moderately high risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md/assets/prompt-lite.md の「# 案件メモ」(ユーザー入力)やSKILL.mdの本文を、HTML出力時にそのままLLMが文章として取り込んで各セクションの見出し直後の「.msg」等に反映するため、アウトサイダーが投稿したフリーテキストがプンプト注入として混入しうる。