qa-only

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow for /qa uses the browser tool to navigate to a user-specified or auto-detected target URL and then ingests page content (via goto, snapshot, links, and console output) into the agent’s LLM context; if that target URL contains outsider-authored free text (e.g., arbitrary web page content), it can become indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup step conditionally downloads and executes the bun installer at runtime (curl -fsSL "https://bun.sh/install" -> bash "$tmpfile"), meaning the skill fetches and runs remote code from https://bun.sh/install as a required dependency.