sync-test-cases-with-tms

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow includes a “Pull” step that downloads test scenarios from Testomat.io (outsider-authored public/remote content) and saves them as local Markdown files, which the CLI then reads/ingests as free text into the agent’s runtime context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires running "npx check-tests@latest" (appears in SKILL.md and references/TESTOMATIO_CLI.md), which fetches and executes remote code from the npm registry at runtime, so the package fetch is a runtime external dependency that executes remote code.