generators-force-update

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's VersionChecker implementations (templates VersionChecker.swift and the UpdateCheckModifier default checker) fetch and parse remote JSON from a configurable URL (RemoteJSONVersionChecker) and query Apple's public iTunes lookup API (AppStoreLookupChecker), and those untrusted public responses are used to compute UpdateRequirement that directly controls blocking vs. UI/actions, so third-party content can influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instantiates runtime checks that fetch and decode remote JSON from a configurable endpoint (default https://api.example.com/app-config) and queries the iTunes API (https://itunes.apple.com/lookup?bundleId=...) whose responses directly control whether the app shows hard/soft update prompts and their messages, so these URLs are runtime external dependencies that control agent prompts.