hs-release

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow runs uv run --directory hindsight-dev generate-changelog <version>, which uses OPENAI_API_KEY to LLM-summarize commit text between tags; those commit messages/diffs are authored by other contributors (outsider sources) and are ingested as free-form text into the LLM context via the changelog generator.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to run release scripts that bump versions, tag and push commits directly to origin/main (triggering CI to publish packages), create/modify branches and worktrees, and commit & push files—irreversible, outward-facing changes to the repo and remote state—so it clearly directs the agent to modify the machine/repository state in a dangerous way.