loops

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s required workflow is to author/install/run LOOP.md by searching a public directory (npx agenticloops find <query> / browsing agenticloops.dev) and then installing an existing loop; that runtime path can ingest outsider-authored free text from fetched loop manifests/prompts (and possibly scraped “run receipts”/descriptions) into the agent’s LLM context when the harness executes the installed loop.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the workflow runs npx agenticloops which fetches loop manifests from external sites (e.g., https://agenticloops.dev and https://github.com/5dive-ai/loops or owner/repo GitHub entries), and those remote LOOP.md files contain the prompt/instructions the agent will execute at runtime, so external content can directly control the agent.