upgrade
Upgrade the NotFair plugin to the latest version. Updates the marketplace repo, installs the new version to the plugin cache, and updates installed_plugins.json. Use when asked to "upgrade notfair", "update notfair", or "get latest version". Also handles inline upgrade prompts when a skill detects UPGRADE_AVAILABLE at startup.
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md Step 8 (“Read `$NEW_CACHE_DIR/CHANGELOG.md`”) ingests outsider-authored free text from the marketplace plugin’s CHANGELOG.md into the agent context at runtime after fetching/resetting the marketplace repo (public/community code).
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill runs git fetch/reset on the marketplace repo at runtime (git fetch origin; SKILL.md:54-55) and then executes a binary from the fetched plugin cache (bin/notfair-update-check; SKILL.md:168-169), meaning remote repository content fetched at runtime can supply and control code that is executed—no explicit remote URL is shown in the files.
- Repository
- nowork-studio/NotFair
- Commit
8d9d54b
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.