analyzing-supply-chain-malware-artifacts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's runtime agent (scripts/agent.py) explicitly fetches and parses live package metadata from public, user-generated registries (https://registry.npmjs.org/... and https://pypi.org/pypi/...) which the agent reads as part of its workflow and can influence analysis decisions.