codeflow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source is CodeFlow’s runtime GitHub/PR/Obsidian “input” path where outsider-authored repository/PR or markdown content is fetched and parsed client-side from the user-provided repo/PR/vault into the in-browser analysis.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly points to and/or fetches remote runnable code at runtime: the hosted app https://codeflow-five.vercel.app/ serves JavaScript that runs in the browser, and the installer/self-host flow does a git clone of https://github.com/braedonsaunders/codeflow.git (fetching code that is then opened/executed), so these external URLs are runtime dependencies that execute remote code.