rlm-project-assistant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly configures external LLM providers (e.g., OpenAI/OpenRouter/DeepSeek/LiteLLM/Ollama) as the "root" LLM whose generated JSON commands drive the RLM orchestrator (see "Configure LLM Provider", "Step 4: LLM Provider Selection", and the config examples using api.openai.com / openrouter.ai / deepseek), so untrusted third‑party model outputs are ingested and can directly control tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly fetches and executes remote installer code via "curl https://sh.rustup.rs | sh" and also clones and builds a remote repository ("https://github.com/softwarewrighter/rlm-project") which is then run locally (rlm-server), so these runtime-fetches install/execute external code that the agent relies on.