agents-sdk-dev

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content contains deliberate patterns that enable remote code execution and persistent, unattended permission grants (auto-approval) that can be abused for unauthorized file access, credential manipulation, or data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). This skill’s runtime flow only ingests the user’s provided goal/answers for scaffolding and then loads first-party reference files from its own references/ directory (plus “latest live docs” fetched by WebFetch/WebSearch), but the provided workflow does not describe ingesting arbitrary outsider-authored free text from any monitored external feed/queue or unsolicited community input.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to "Always fetch the latest live docs" and lists the official SDK docs (https://docs.anthropic.com/en/docs/agents-and-tools/claude-agent-sdk, https://docs.cursor.com/tools/sdk, https://openai.github.io/openai-agents-python/) which the agent would fetch and use to drive prompts/instructions, so these external URLs are runtime dependencies that can directly influence agent behavior.