by-harness

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The codebase contains a built-in remote runtime updater (update_runtime.py) that can fetch a manifest from a remote URL and materialize/merge arbitrary files into the repo (including repo-root targets), and the provided scaffold/template enables/points to a remote manifest by default and auto-invokes checks from init/task_switch — this creates a high-risk supply-chain/backdoor vector (remote file injection that can overwrite scripts/hooks which are later executed), plus hooks (context-injector, convention-check, etc.) collect and inject local git/workspace data into LLM system messages (risking data leakage to external LLM services).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's upgrade workflow explicitly fetches remote manifests and files (see "老仓库升级" in SKILL.md and the use of scripts/update_runtime.py with manifest_url / --check-remote, plus runtime manifest entries pointing to raw.githubusercontent.com), so it ingests external, potentially untrusted web content that can change the runtime/tools and thus influence subsequent agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime manifest and update process explicitly reference and can fetch hook and script files from raw.githubusercontent.com (for example https://raw.githubusercontent.com/xmzDesign/santong-skill/main/by-harness/root/.claude/hooks/context-injector.py), and the documentation and update_runtime behavior show these fetched hook scripts would run in the agent runtime (controlling prompts/behavior or executing code) when a remote manifest/update is used.