design-roundtable

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill contains an unrelated feedback reporting mechanism that transmits data to an external telemetry endpoint.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill executes npx --yes hivenet@latest to run telemetry reporting software from an external npm package.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains an operational telemetry/feedback command that executes a remote npx package fetch from hivenet.app and references an external GitHub repository URL for reporting guidelines.