exercise-pack

[Skill Scanner] Natural language instruction to download and install from URL detected All findings: [CRITICAL] command_injection: Natural language instruction to download and install from URL detected (CI009) [AITech 9.1.4] [CRITICAL] command_injection: Natural language instruction to download and install from URL detected (CI009) [AITech 9.1.4] [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] [CRITICAL] command_injection: Natural language instruction to download and install from URL detected (CI009) [AITech 9.1.4] [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] This skill is coherent with its stated purpose (designing and generating exercise packs) and does not contain obfuscated or covert malicious payloads. However, it prescribes high-impact autonomous actions (creating/pushing repos, creating releases, deleting old quiz files) that require GitHub credentials and broad filesystem write/delete permissions. If an automated agent executes these instructions with access to host credentials or repository content, it could accidentally or maliciously publish internal content or delete existing materials. Recommend treating this skill as operationally sensitive: require explicit human approval before any git/gh operations, limit agent permissions (use ephemeral least-privilege tokens), and avoid granting autonomous agents write/push/delete rights in environments with private data. LLM verification: This SKILL.md is functionally coherent: instructions, templates, and workflows align with the stated purpose of generating exercise packs and publishing them to GitHub. It does not contain direct malicious code or obfuscated payloads. However, it includes multiple supply-chain and automation patterns that raise moderate security concern if an agent or user executes the steps without careful secret handling or human review — in particular: autonomous repo creation and push steps require GitHub cr