agent-experience

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path uses WebFetch to fetch public documentation pages (seeded by a user-provided URL) and then retains the fetched page prose in the subagent’s LLM context for reasoning, which is outsider-authored free text (public web content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs subagents to use WebFetch at runtime to read the user-supplied documentation site (e.g. the seed target URL such as https://docs.example.com or the user-provided docs URL), and those fetched pages directly determine what the agents do (including potentially running shell commands if Exec mode allows), so the target docs URL is a runtime external dependency that can control agent prompts/execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly permits spawning subagents that run real shell commands (npm/pip install, git clone, curl, write per-agent .env files, rm -rf temp dirs) and runs credential auto-discovery commands against the host (printenv, grep of dotfiles, op/security), which can and do modify or affect the machine's filesystem and state even if sudo is not requested.