compose-preview

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs agents to download-and-run remote installer scripts (e.g., the SKILL.md examples and the bundled scripts/compose-preview stub that curl-s|bash "https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh" and the install.sh/bootstrapper that fetches the CLI), and the installer and CLI further contact public hosts (maven.google.com, api.github.com, etc.), so untrusted third-party content is fetched and executed in the normal agent workflow and can materially change tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime bootstrap/installer explicitly runs remote install scripts via curl|bash — e.g. https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh and https://raw.githubusercontent.com/yschimke/skills/main/scripts/install.sh — which fetch and execute remote code and are relied on to install the required CLI, so they directly execute external code at runtime.