compose-preview

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and execute remote content (e.g., "curl -fsSL https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh | bash") and to fetch/read public GitHub raw URLs and repo data (git fetch/show, raw.githubusercontent.com preview PNGs, gh api), which are untrusted, user-hosted third‑party resources that the agent is expected to read/execute and which can materially change tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation instructs running a remote installer at runtime via "curl -fsSL https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh | bash", which fetches and immediately executes remote code and is presented as the required bootstrap for the CLI, so it represents a runtime external dependency that executes code.