supply-chain-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 2/Step 3/Step 4 the workflow reads free text from the user-supplied repository path (SECSKILL_REPO_PATH) by cat/grep/jq and passes that repository content into tools like npm audit, govulncheck, trivy fs, and trufflehog, so an outsider who can submit/poison the repository contents can have their text ingested without any item-level selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites include curl | sh installation commands that fetch and execute remote install scripts at runtime (e.g., https://raw.githubusercontent.com/anchore/syft/main/install.sh and https://raw.githubusercontent.com/anchore/grype/main/install.sh), which run remote code to install required tooling used by the skill.