ln-820-dependency-optimization-coordinator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the SKILL.md explicitly says to fetch missing shared/ files via WebFetch from https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path} and mandates loading shared/references/* (plus uses public registry queries like npm view/PyPI JSON API) so the agent will ingest public third-party content that can materially influence upgrade and delegation decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime fetching of required runtime-contract and reference files via https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}, and those fetched markdown files are mandatory reads that directly control the agent's runtime behavior and prompts if the local shared/ directory is absent.