pocdd

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via the /poc SOURCE → pocdd-create workflow, which explicitly “read[s] the file, fetch[es] the URL, or read[s] the issue” from a user-supplied SOURCE (e.g., arbitrary URL/issue text) and then writes it into the .pocs/ POC artifact that the agent subsequently loads as its prompt/spec.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly accepts a SOURCE URL (e.g. "https://provider.dev/docs") for /poc and the create/work procedures state "fetch the URL" and bootstrap the POC from its contents at runtime, meaning fetched remote content would directly shape the agent's prompt/goal.