audit-site

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via runtime crawling of the target website: the site-mapper agent uses Playwright to crawl pages and produce sitemap.json, which is then read by downstream agents (UX/accessibility/performance/bug runner) as grounding input; this includes arbitrary page text authored by third parties on the audited site.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes and depends on executing remote packages at runtime (e.g., installs/runs the Playwright MCP server via npx --yes @playwright/mcp@latest and fetches axe-cli, pa11y, and Lighthouse on demand with npx), which downloads and executes external code required for the audit.