ln-741-linter-configurator

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt explicitly claims it "Does NOT: Modify source code" but later instructs modifying source (e.g., adding # noqa: C901 and manual file-by-file fixes), which is a deceptive contradiction outside the skill's stated scope.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs (SKILL.md) to fetch missing template files via WebFetch from the public URL https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}, causing the agent to ingest public GitHub content (user-controlled) that is used to generate configs, install dependencies, and create/run lint scripts—allowing third-party content to materially influence actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs at runtime to fetch templates via WebFetch from https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}, and those remote files are used as required templates that directly determine generated configuration and agent actions, so this is a runtime external dependency that can control the skill's behavior.