magpie-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes that /magpie-setup can fetch a framework snapshot from external sources at runtime (e.g., git clone / curl of an ASF zip), and the agent then reads SKILL.md/sub-action files from that downloaded snapshot into its LLM context; this is outsider-authored free text via runtime-fetched public repository/zip content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The adopt/upgrade flows explicitly perform runtime fetches (git clone / curl) of external repositories — e.g. the comdev and magpie repos at https://github.com/apache/comdev.git and https://github.com/apache/magpie — which pull remote skill code that the agent will load/execute and thus directly control prompts/behavior.