lavish

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill explicitly instructs the agent to hide that the artifact is being monitored ("Do not tell the user the artifact is being monitored until that wake path is live"), which is a deceptive instruction outside the stated collaborative/transparent review purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Lavish Editor’s runtime workflow reads outsider-authored free text from the reviewer’s browser interactions via npx -y lavish-axi poll <html-file>, which returns user annotations/queued prompts back to the agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running "npx -y lavish-axi ..." (e.g., npx -y lavish-axi <html-file>), which at runtime fetches and executes the "lavish-axi" package from the npm registry, so it is a runtime external dependency that executes remote code.