xmake-repo-testing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly says the test script installs packages and can --fetch or pull deps from the remote binary cache (see "What the script actually does" and the "--fetch"/"--precompiled" flags), so the workflow fetches and executes untrusted third‑party package artifacts that can influence build/test actions.