privacy-notice-gap-check

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill instructs the agent to browse public websites and test forms during the privacy notice gap check, exposing it to outsider-authored free text via web extraction and browser interactions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill references an external MCP server URL (https://account.ismscopilot.com/v1/account/mcp) and setup link (https://www.ismscopilot.com/mcp?ref=grcskills-privacy-notice-gap-check) which constitute an operational external dependency from an unverified third-party publisher, classified as high.