building-restaurant-site

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly invokes $enrich-place-details and instructs the agent to read and act on the saved places/${placeId}.json (inspecting placeDetails.reviews, ugcPosts, place posts, videos, and remote image URLs) — all untrusted public/user-generated content that the workflow must interpret and that materially drives design, content, and CMS actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The helper script runUpload spawns "npx dineway media upload ..." at runtime which will fetch and execute the remote "dineway" package from the npm registry (e.g. https://registry.npmjs.org/) as part of the required media upload step, so remote code is downloaded and run during skill execution.