cloudflare-email-service

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Cloudflare Email Routing/Agents SDK runtime ingests outsider-authored email content at the Worker email(message, env, ctx) handler via message.raw / message.headers and parses it (e.g., PostalMime.parse(await email.getRaw())) into free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime retrieval of authoritative docs (which can alter agent instructions) from https://developers.cloudflare.com/email-service/ and https://github.com/cloudflare/agents/tree/main/docs, so external content fetched at those URLs could directly control prompts.