find-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill directs the agent to search and install skills from the open skills ecosystem (via npx skills find, links to https://skills.sh, and the provided scripts/install-skill.sh which runs npx skills add <owner/repo@skill-name>), which fetches code and metadata from public third-party repositories and therefore exposes the agent to untrusted user-generated content.