xiaobai-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The runtime path downloads outsider-authored SKILL.md files from public GitHub URLs (e.g., raw.githubusercontent.com/vercel-labs/skills/.../SKILL.md, raw.githubusercontent.com/mineru98/.../SKILL.md, and GitHub repo ZIPs for baoyu-skills/mattpocock/skills), which are then installed into ~\.codex\skills\... and thus become LLM-readable skill prompt content in Codex.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The PowerShell installer downloads SKILL.md and entire repos at runtime from external URLs (e.g. https://raw.githubusercontent.com/vercel-labs/skills/main/skills/find-skills/SKILL.md, https://raw.githubusercontent.com/mineru98/llm-proxy-skills/main/skills/frontend-master/SKILL.md and via https://codeload.github.com//zip/refs/heads/ for JimLiu/baoyu-skills and mattpocock/skills), which will inject remote skill instructions into the agent runtime and are used as required dependencies by the install/curation workflow.