anthropic-managed-agents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's Mode B workflow and the primer explicitly require declaring MCP connectors by URL (SKILL.md Mode B "MCP connectors needed (list external systems → map each to an MCP server URL)" and references/primer.md "Declare on the agent ... mcp_servers [url]"), which allows the agent at runtime to call arbitrary external MCP servers and ingest their responses — untrusted third-party content that can materially influence tool use and agent decisions, enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The primer includes an example MCP server declared on the agent (https://api.githubcopilot.com/mcp/) which is contacted at agent runtime via the mcp_toolset and can supply tool responses that directly influence agent behavior or trigger remote code/tool execution.