first-run

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime path includes opening a Streamlit “trajectory viewer” and instructs the user to expand the System prompt section and scroll through turns, which implies the agent/trajectory data (including model prompts and tool outputs) is loaded into the LLM context; this trajectory content is not explicitly guaranteed to be only user-authored and can include outsider-authored text from the browser task (Wikipedia pages) via the headless browser tool.