git4d-runtime

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). These links are a mix of trusted vendor pages (NVIDIA) and likely official sites (kamui.ai) — but they also include small/unknown GitHub repositories/releases and a third‑party news page that references downloadable installer assets, which are common channels for unvetted executables and thus represent a moderate-to-high risk for malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). The required runtime workflow runs scripts/git4d_runtime_check.py, which ingests outsider-authored free text from the local Git repository’s commit metadata and file paths via git log --all ... --pretty=format:... --name-only and git status --porcelain, then places that text (e.g., commit subjects/authors and touched file names) into the LLM context through the agent’s generated JSON/text report.