using-git-worktrees

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required "Run Project Setup" steps in SKILL.md explicitly run commands like npm install, pip install, cargo build, and go mod download which fetch and execute untrusted, user-contributed packages from public registries (npm/PyPI/crates.io) as part of the workflow, so third-party content can directly influence execution and decisions.