lean-ctx

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw GitHub URL points to an install.sh script that the skill instructs users to curl and pipe to bash (a high-risk pattern for executing remote code); the Apache license URLs are official and benign.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). lean-ctx’s required runtime workflow can ingest outsider-authored free text because its Hybrid/MCP modes include “cached reads/search” and shell hooks that read arbitrary project files/directories and execute commands like curl -s <url> at runtime based on user/agent prompts, thereby allowing external users to introduce poison text into files/inputs that the LLM then reads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup directs users to download and execute a remote install script via curl piped to bash (executes remote code) at https://raw.githubusercontent.com/yvgude/lean-ctx/main/skills/lean-ctx/scripts/install.sh, which is a runtime external dependency used to install the tool.