related-skill

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill openly advertises discovering and installing skills from the inference.sh registry, but its top banner pushes an unrelated package (belt-sh/cli) to install, which is promotion outside the skill's stated purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs npx skills search and npx skills list against the public inference.sh skill registry, so third-party skill names and descriptions enter the agent's context only after it issues a search, which makes this a low-risk community registry path rather than a monitored feed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installing skills via npx skills add from GitHub-style locators. The inference-sh/skills@* installs come from the skill's own vendor and are strong/official. The banner install belt-sh/cli is a separate installed skill whose first-party link to inference.sh is not evidenced, so it is stable, attributable but unofficial content, which makes it medium.