claude-agent-sdk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's RESEARCH_AGENT system prompt (src/agents/agent-definitions.ts) explicitly instructs the agent to use "web_search" and "read_document" for gathering information and the MCP Playwright config (src/ai/mcp-registry.ts) provisions web-automation tools, meaning the agent is expected to fetch and interpret arbitrary public web pages/documents (untrusted third‑party content) as part of its workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes MCP server commands that will fetch and execute remote packages at runtime via npx (e.g., "npx @playwright/mcp@latest" and "npx -y @modelcontextprotocol/server-filesystem /workspace"), which constitutes downloading and running remote code used by agents.