finding-google-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow fetches a public GitHub repository index from raw.githubusercontent.com/google/skills/main/index.json (and optionally subsequent community skill files), which constitutes reading package or catalog metadata from an external source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill fetches a remote catalog index from GitHub at runtime and explicitly instructs the agent to fetch and follow instructions from arbitrary entrypoint URLs found within that catalog.