cubrid-jira-dup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow reads full descriptions and comments of plausible candidates from the public CUBRID JIRA (CBRD project), where any outsider can file issues or post comments, so this is Jira ticket reading that the agent does not first select beyond the search.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs a setup-time uv tool install from a Git locator, and that installed code runs as the CLI, so it is an operational dependency; the repository is under an individual's account (vimkim) rather than a recognized CUBRID or enterprise publisher, and shows no concrete warning signs, so it is common/reputable unofficial and rated medium.