agent-context-manager

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes Agent Context documents whose body is stored and later loaded via runtime fetch (by context_document_id), meaning outsider-authored free text can be ingested if a user/outsider can create or edit those documents (e.g., via create/update), and the workflow does not inherently require selecting a specific item beyond an ID the workflow is given.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls the AgentPMT MCP/REST endpoints at runtime (https://api.agentpmt.com/mcp/ and https://api.agentpmt.com/products/purchase) to fetch live schema and get_instructions responses that directly control agent prompts and behavior, so these runtime endpoints are flagged.