ai-scanner-garak

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly shows creating browser-based chat UI targets by arbitrary URL (Setting Up a Target → "Browser-based Chat UI") and running scans (scan_job / garak_runner) that ingest and interpret those target responses to compute ASR and trigger downstream actions/webhooks (config/initializers/scan_hooks.rb), so untrusted third‑party content can influence the agent's decisions and behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README's Quick Install runs remote code via curl -sL https://raw.githubusercontent.com/0din-ai/ai-scanner/main/scripts/install.sh | bash (and the project is obtained via git clone https://github.com/0din-ai/ai-scanner.git), which fetches and executes external code used to install/run the skill.