codebase-to-course

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates embedding "original code exactly as-is" into the generated single-file HTML (including code↔English translation blocks) and to read/clone a repo or the current project, so any secrets present in the codebase would be copied verbatim into the output, creating a direct exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly instructs the agent to fetch and clone arbitrary GitHub repositories ("If the user provides a GitHub link, clone the repo first (git clone ...)") and to read README/main entry points/UI code from that public repo to drive analysis and course generation, which means untrusted third‑party content will be ingested and can materially influence the agent's outputs and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly directs the agent at runtime to clone user-provided GitHub repositories (e.g., "git clone https://github.com/user/repo /tmp/" or other git URLs), which fetches remote code that the agent then ingests to drive its analysis and course-generation, so this external content can directly control prompts/outputs and is a required runtime dependency.