qa

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can enter the LLM context via the runtime browser-driven page content/evidence: the skill navigates to a user-supplied URL (public web or tunneled localhost) using browser-harness, then the agent is instructed to return “evidence” and screenshot-based findings, which typically requires the LLM to ingest page text/DOM-derived content from that outsider-controlled site.