xbox-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow researches Xbox game listings, reviews, and catalog data via Crawlora API endpoints, which can include user-submitted reviews or store descriptions containing untrusted text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill relies on an external API endpoint (api.crawlora.net) accessed via a bundled script (scripts/crawlora.sh) for operational instructions or data feeds, but Crawlora lacks established first-party provenance or independent cryptographic verification, making it a weak/unknown runtime dependency.