theharvester

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs theHarvester against a domain, and its passive providers (such as crtsh, certspotter, and any search-engine backends selected by -b all) return web and certificate-transparency content that the agent reads as results without selecting specific items, but an outsider can only influence this by publishing content the providers index, so it is low rather than medium.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs cloning the upstream theHarvester repository and then running uv sync and uv run on it, so the cloned code is installed and executed; the repository is maintained by an individual (laramies), which makes it a reputable unofficial source (medium) rather than strong first-party provenance.