gstack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can be ingested when the required runtime workflow uses the browser browse tool to read page content (e.g., $B text, $B html, $B snapshot, or $B links) from public/third-party web pages the user navigates to, which the tool wraps as “UNTRUSTED EXTERNAL CONTENT” and feeds into the agent context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's setup step, when bun is missing, downloads and then executes the remote installer script at runtime via curl -o "$tmpfile" and bash "$tmpfile" from https://bun.sh/install, which fetches and runs external code as a required setup dependency.