sandcastle

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly provisions sandboxed agents with host tokens and CLI/network access, runs arbitrary commands via "bang-substitution" and install hooks, and authorizes agents to push/close GitHub resources — enabling credential exposure, data exfiltration, and unauthorized remote modification if misused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow runs an “implement prompt” that uses a bang-substitution preprocessor to execute a ticket-list fetch command (e.g., gh issue list ... --json ... --jq ... [.comments[].body]) and inlines outsider-authored GitHub issue and comment text into the sandbox agent prompt without first selecting a specific item.