clone-website

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly instructs systematic extraction and downloading of full site content (text, images, video, SVGs, favicons, manifests) and provides scripts to enumerate and fetch those assets without mentioning consent, which constitutes deliberate data-exfiltration and content-theft behavior suitable for abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s required runtime workflow uses browser MCP to navigate to the user-supplied $ARGUMENTS URLs and then extracts element.textContent and other live DOM text from the target pages to write spec files and dispatch builder prompts, so outsider-authored page text is ingested.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill parses and fetches user-provided target URLs ($ARGUMENTS) at runtime and then injects verbatim extracted site content into builder prompts (see "Text Content (verbatim)" and "The full contents of its component spec file (inline in the prompt)"), so remote site content can directly influence agent instructions.