swe-management-talk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow ingests outsider-authored free text when the source is a JIRA ticket key: it fetches issue comments via GET /rest/api/3/issue/<KEY>?...&comment, and the “most recent substantive comment” (authored by others) is then rewritten and placed into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly describes performing runtime Jira REST API calls (e.g., GET /rest/api/3/issue/?fields=summary,status,priority,assignee,comment and POST /rest/api/3/issue//comment) to fetch ticket content that is injected into the agent's context and thereby directly controls the agent's prompts/output.