codebase-cleanup-deps-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly fetches and parses public package and advisory data from third‑party sources (e.g., registry.npmjs.org, pypi.org, rubygems.org, bundlephobia.com, ossindex.sonatype.org), so it ingests user-maintained/untrusted content as part of its vulnerability- and dependency-analysis workflow and could therefore be exposed to indirect prompt injection.