agentic-development

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). The skill’s runtime workflow is an agentic “Explore-Plan-Execute-Verify” pattern that can call tools like web_search / read_webpage (public web content) and then feeds the extracted page text back into the LLM context via tool results; this is an outsider-authored free-text source path (web pages fetched at runtime → tool_result content → LLM messages).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes a read_webpage tool that performs runtime HTTP GETs of arbitrary URLs (response = await ctx.deps.http_client.get(url)) and returns response.text for use in the agent context (and an example web_search calls https://api.search.com/search), so fetched external webpage content can directly influence agent prompts/behavior.