restaurant-booking

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime the skill navigates to outsider-authored public web pages (e.g., OpenTable/Resy) and then calls /sessions/{session_id}/page/scrape with only_main_content:true, which returns readable page text that the agent can place into its LLM context for “confirmed” detection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime HTTP requests to Orthogonal/Notte endpoints (via $GOOSEWORKS_API_BASE which defaults to https://api.gooseworks.ai/v1/proxy/orthogonal/run and also shown as https://api.orth.sh/v1/run), which the skill depends on at runtime to execute remote browser-automation actions (i.e., executing remote code/instructions).