claude-code-agent-harness-architecture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via runtime tool results from external sources—e.g., the “Browser”/“Search” tools (navigate/browse/screenshot/click, ripgrep_search/file_search) and MCP resources/prompts—whose fetched page text or server-provided content is then included in messages for llmClient.chat({ messages: context.messages, ... }) after buildContext(deps) and tool execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime config will spawn an MCP server via the command "npx -y @modelcontextprotocol/server-postgres", which will fetch and execute an external npm package at runtime (remote code execution risk).