email-creative-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill explicitly instructs reading the destination landing page at runtime (“Read the destination — extract the page's headline…”) and then uses that extracted prose as the message-match anchor for the email, which is outsider-authored free text from an arbitrary URL.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly fetches and "read[s] the destination" (the user-supplied landing page / destination URL) at runtime and uses the page's headline/claims as the message-match anchor that directly controls prompt generation and output, so the destination URL (the user-provided landing page URL) is a required runtime external dependency.