ln-210-epic-coordinator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required workflow (Phase 3 and Phase 5b) explicitly reads and interprets user-generated, public GitHub issue data (e.g., "gh issue list -R {REPO} --label epic") and may fetch files from raw.githubusercontent.com, and it uses that content to decide CREATE/REPLAN operations and to update/create/archive Epics, so untrusted third‑party content can materially influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly states that if local shared/ files are missing it will "fetch files via WebFetch" from https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}, and those fetched "MANDATORY READ" reference markdowns are required at runtime to control the coordinator's prompts and behavior, so this is a runtime external dependency that directly controls agent instructions.