baogong

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime path: Phase 1 Scout performs web_search/WebFetch/agent-browser to fetch public pages (S1/S2/S3) and then injects extracted text into the LLM via snapshot.expert_outputs.scout_report/interview_intel, which becomes part of subsequent node context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches user-supplied http/https URLs at runtime (see "包含 URL（http/https 开头） → WebFetch 获取内容" and the WebFetch/agent-browser/Chrome MCP fallback chain) and injects retrieved page content into the LLM context (scout_report/interview_intel), so arbitrary external URLs (http://… / https://…) can directly control prompts; flagged: HTTP/HTTPS URLs provided to WebFetch.