cro

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow analyzes a marketing page the user supplies by URL (SKILL.md description, "a URL shared for feedback"), so the agent must fetch and read arbitrary web page text, which is outsider-controllable (e.g., user-submitted testimonials or reviews), but only after the user selects that URL.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill directs the agent to "use" an individual-owned GitHub playbook (coreyhaines31/marketingskills) to govern post-submission enrichment behavior at runtime, so it is an inbound instruction dependency with unofficial, reputable-but-not-first-party provenance, which is medium.