product-changelog

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a changelog-writing guide, but its first-line instruction installs a package from a different GitHub org (belt-sh/cli) than the inference-sh source used everywhere else, which is an unverified install pointer rather than clear malicious intent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The decisive boundary is the setup instruction at line 7 (npx skills add belt-sh/cli), which installs skill material from a repository whose ownership is not established as the inference.sh vendor, so it is an unverified-publisher dependency and the highest tier, while the inference-sh sources (lines 15, 267-268) are strong first-party and the belt app run calls are outbound control-plane only.