product-design-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The required workflow explicitly performs “Search public sources” (Reddit, X/Twitter, Hacker News, Stack Overflow, GitHub issues/discussions, forums/blogs/reviews/YouTube comments, etc.), which at runtime will fetch outsider-authored free text from the public web and feed it into the agent’s LLM context for clustering/ranking.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly tells the agent to load a local user-context and "run its preflight script when local shell access is available," which directs execution of local scripts (potentially changing system state) even though it does not explicitly request sudo or system-file edits.