managed-memory

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s runtime workflow exposes Databricks Unity Catalog managed-memory tools (search_memory, get_memory, list_memories, etc.) that ingest user-authored conversation text as the query to POST .../entries:search and as parameters for saving/retrieving memories, so outsider free text can be fed into retrieval without selecting a specific pre-existing item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to the Databricks memory-store endpoints (e.g. "$DATABRICKS_HOST/api/2.1/unity-catalog/memory-stores" and the store entries API "/api/2.1/unity-catalog/memory-stores/{DATABRICKS_MEMORY_STORE}" referenced via https://), whose returned memory contents are inlined into the agent's context and therefore can directly influence prompts/behavior.