landing-page

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md Phase 1 "Research" and README explicitly require the agent to fetch/scrape the client's public website (homepage and key pages, image directories) given a user-provided URL, meaning the agent ingests arbitrary third‑party web content and uses it to drive extraction, build, verification, and deployment decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README includes a one-line installer that runs remote shell code via bash <(curl -sL https://raw.githubusercontent.com/Aston1690/claude-skill-landing-page/main/install.sh) (which then git-clones https://github.com/Aston1690/claude-skill-landing-page.git), so remote content would be fetched and executed as part of installation and is required for the skill—constituting a high-confidence execution-of-remote-code risk.