decodo-web-scraping

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow uses the Decodo CLI/MCP/raw HTTP API to fetch and return scraped page/SERP/social content (outsider-authored web text) which the agent then consumes as tool output/LLM context, creating an indirect prompt-injection path from arbitrary fetched content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a direct install command that pipes remote shell code into the shell ("curl -fsSL https://decodo.github.io/cli/install.sh | sh"), which fetches and executes code at runtime from https://decodo.github.io/cli/install.sh.