clodex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill references reading GitHub release notes via URL when upgrading clodex, which is an active search/fetch of public documentation/web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references the npm package @bman654/clodex and its GitHub repository bman654/clodex as setup and runtime channels, which constitute a common/reputable unofficial operational dependency.