enhance-skill-by-derailment

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md workflow explicitly fetches and requires reading SKILL.md and reference files from arbitrary GitHub repositories using gh api (the "Remote skill" section), which ingests public, user-generated content that the subagent must read and act on—allowing untrusted third-party instructions to influence tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow explicitly fetches remote skill files at runtime using the GitHub API (e.g., gh api repos/{owner}/{repo}/contents/SKILL.md → https://api.github.com/repos/{owner}/{repo}/contents/SKILL.md), and the retrieved SKILL.md and reference files are injected into the subagent's context and thus directly control agent prompts/instructions.