Vvettd.
AddSign in

unknown

zeroclaw-labs/zeroclaw/.claude/skills/squash-mergeOpen on GitHub
From the author

No descriptionNo description was stored for this record.

Compare
Overall score BSecurity severity MediumAssessed Oct 28, 2026Content hash 159e25dScope: this assessed content onlyAssessment
AssessmentFile structure 1Findings 2VersionsDisputes

Findings2

Selected finding

Close and return to the list
Medium

References external URL — review for indirect prompt injection risk

SKILL.md No line number found in the scanner's text.
Sets Security severity to Medium

SKILL.md or references/ links to an external web page. That page can change after review and could carry instructions aimed at the model.

What the scanner sawExternal URL(s) detected in SKILL.md — referenced content can change after audit
Found by vettdRule VTD-0088Security categoryCounts toward Security severityContent hash 159e25d
How to fix

Link to content you control, or to a specific commit or release where the host offers one. Tell the agent to treat fetched pages as reference, not as instructions.

All findings in this fileDispute this finding

2 findings and 1 note