manage-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md "Install" and "Search" workflows explicitly instruct using skills-manager-cli to fetch and install skills from public git URLs and the skills.sh marketplace (e.g., "skills-manager-cli skills install https://github.com/..." and "skills-manager-cli skills install vercel-labs/agent-skills@..."), which ingests untrusted, user-generated third-party repositories that become visible to and can change the agent's behavior when synced.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly performs runtime git installs (e.g., "skills-manager-cli skills install https://github.com/anthropics/skills.git"), fetching remote repositories that are then synced into agent skill directories and can contain prompts or executable code that directly control agent behavior.