create-tldr-page

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill ingests outsider-authored free text when it performs #fetch <URL> at runtime and then uses the fetched page/manual/help text to generate the tldr content (public web content scraped/read as prose).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches remote documentation at runtime (e.g., https://raw.githubusercontent.com/jhauga/tldr/refs/heads/main/pages/common/git.md and any user-supplied URL passed to "/create-tldr-page #fetch "), and that fetched content is used directly to generate the agent's tldr output, so it can control prompts and perform prompt-injection at runtime.