personalization

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). SKILL.md instructs the agent to use ColdIQ MCP/API to fetch bucket content, including page text via mcp__coldiq__fetch_page_content and self-authored/engaged content, which at runtime would require the agent to ingest third-party/free-form web or profile text (outsider-authored) into the LLM context, rather than only using the user’s own text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes a runtime install-and-run command "COLDIQ_API_KEY= npx -y @coldiq/mcp@latest" which fetches and executes remote npm package code during runtime, so it can directly execute remote code.