debugging-code

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's install script (scripts/install-dap.sh) and the installer steps in references/installing-debuggers.md explicitly curl the GitHub Releases API and download release assets from https://github.com (e.g., querying api.github.com/releases/latest and fetching js-debug tarballs), which causes the agent/user workflow to fetch and act on public third‑party content that can influence which binaries are installed and run.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The provided install script (scripts/install-dap.sh) performs runtime fetches from https://api.github.com/repos/AlmogBaku/debug-skill/releases/latest and downloads an executable from https://github.com/AlmogBaku/debug-skill/releases/download/... (and may fall back to go install github.com/AlmogBaku/debug-skill/cmd/dap@latest), which downloads and installs remote executable code at runtime and is a required dependency for the skill.