private-context-bootstrap

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime bootstrap workflow clones/syncs a “private remote data repository” from AGENTDESK_PRIVATE_REMOTE (or secret manager) and then decrypts/materializes its YAML/JSONL/PDF contents into AGENTDESK_PRIVATE_HOME, so the agent LLM context can ingest outsider-authored free text from that remote repository.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill's bootstrap step explicitly clones/syncs a remote repository specified by the AGENTDESK_PRIVATE_REMOTE git URL at runtime, and the fetched YAML/JSONL documents from that repo are loaded as private agent context (directly controlling prompts) and are required for the workflow.