lib-docs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s runtime fetch step ingests provider-published text files (llms.txt/llms-full.txt) from arbitrary docs domains discovered via scripts/llms-probe.sh, meaning an outsider who can publish those files can supply malicious free text for the LLM to ingest.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill probes and then fetches remote llms index/full files at runtime (constructed as "https://${host}${path}" and e.g. /llms.txt or /llms-full.txt), which are ingested as model context and therefore can directly control prompts; the probe/fetch is performed by the script via curl (url template: https://${host}${path}).