semgrep-rule-creator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill's SKILL.md explicitly requires the agent to use WebFetch to read four external public documentation links (e.g., https://semgrep.dev/docs/writing-rules/rule-syntax, https://appsec.guide/docs/static-analysis/semgrep/advanced/, and the semgrep-docs GitHub URL), so the agent will ingest third‑party web content that can materially influence its rule-writing actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's Documentation section explicitly requires using WebFetch at runtime to read external Semgrep docs (e.g. https://semgrep.dev/docs/writing-rules/rule-syntax and https://github.com/semgrep/semgrep-docs/tree/main/docs/writing-rules/), which the agent must fetch and which directly guide its prompt/instruction behavior.