web-to-app

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). 该 Skill 的运行时会把用户提供的网页 URL 交给 scripts/build_app.py 执行 pake <url>；pake 在打包过程中会抓取/渲染该外部网页内容（以及可能的远程图标/注入资源），从而将“非操作用户选择引入的外部网页自由文本”间接进入 LLM 上下文（通过构建/日志/解析链路）。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes the pake CLI at runtime to package arbitrary webpage URLs (e.g. examples shown: https://github.com, https://chat.openai.com, https://example.com and a remote icon https://example.com/icon.png), meaning the build step will fetch remote HTML/JS during runtime and that fetched content can include and execute remote code inside the generated app.