source-to-skill-tree

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow includes “Ingest the Source” (via references/source-ingestion.md), which for runtime-provided URLs/websites or pasted outsider content can fetch/extract arbitrary third-party free text and then feed it into the agent’s context to build the skill tree.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs agents to "browse" and ingest a user-provided source URL at runtime (references/source-ingestion.md: "If it is a URL and the content may have changed, browse it"), so arbitrary external URLs (e.g., a user-supplied https://... source) would be fetched during runtime and could directly control the agent's prompts and outputs.