rust-npm-publish

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's publish pipeline explicitly polls the public npm registry (see the "wait-propagation" step / use of npm view in publish workflow and scripts) to determine when platform packages are visible and to gate publishing, so it ingests untrusted, public npm metadata which can directly influence publishing decisions.