configure-ecc
Warn
Audited by Snyk on Feb 27, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs cloning a public GitHub repository (Step 0: git clone https://github.com/affaan-m/everything-claude-code.git) and then reads, copies, verifies, and even edits SKILL.md and rule .md files from that clone (Steps 2–5), so untrusted third-party content can directly influence installation decisions and subsequent agent actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs "git clone https://github.com/affaan-m/everything-claude-code.git" at runtime to fetch the required ECC repository whose skill/rule files are then copied and used to control agent prompts/instructions, so this external URL is a runtime dependency that can directly control the agent.
Audit Metadata