supply-chain-attack-recon

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). The document provides detailed, actionable reconnaissance and exploitation instructions for software supply‑chain attacks (dependency confusion, typosquatting, workflow injection, secret mining and RCE), including step‑by‑step commands and exploitation chains, which is clearly malicious/deceptive in nature.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill “supply-chain-attack-recon” reads outsider-authored free text from public GitHub by fetching repository contents (including .github/workflows/*.yml files) and other release/SBOM assets via gh api, so an outsider can submit poison via issues/PRs or repo commits that the workflow then ingests during its enumeration steps.