strategy-board

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a third‑party GitHub repository (tronghieu/agent-skills) linked as an optional install source and via npx/manual-zip instructions — installing code from an unverified personal GitHub repo or running npx against it can execute unreviewed code and therefore poses a moderate-to-high supply‑chain / malware risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow in references/workflow.md Phase 1 (“Fact base”) explicitly uses web search / vendor information and may invoke the optional Market Researcher skill, which can ingest outsider-authored web/public content into fact-base.md and then into later LLM-written artifacts (risk via retrieved/scraped free text).