update-shop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow fetches upstream public web content from github.com/vercel/shop via curl/tar, then reads markdown entries from the extracted template-rollout-log/ into the agent’s reasoning context (indirect prompt-injection risk from outsider-authored free text).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches live rollout content at runtime from https://codeload.github.com/vercel/shop/tar.gz/refs/heads/main and then reads those extracted markdown entries (template-rollout-log) to drive planning and apply decisions, so the remote content directly controls the agent's instructions.