distilling-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). It reads outsider-authored free text by fetching candidate skill content from skills.sh (discover) and then reading their GitHub-hosted SKILL.md content during step 2/4 (queue/feed style ingestion of attacker-authored repository text).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent at runtime to fetch external skill content from https://skills.sh/search?q= (and e.g. https://skills.sh/search?q=property+based+testing) and then read GitHub-hosted SKILL.md files into the agent context, which is runtime fetching of external text that can directly control prompts/instructions.