sendcutsend

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's workflow requires running scripts/download_sources.py and explicitly fetching and ingesting public SendCutSend files from https://cdn.sendcutsend.com/specs/... (see references/official-sources.md and SKILL.md) and uses those untrusted, user-visible JSON/markdown sources as authoritative evidence that directly drives pass/fail checks and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime downloader (scripts/download_sources.py) fetches the live SendCutSend source files (e.g. https://cdn.sendcutsend.com/specs/sendcutsend-ordering-guide.md, https://cdn.sendcutsend.com/specs/sendcutsend-catalog.json, https://cdn.sendcutsend.com/specs/sendcutsend-specs.json) which are required at runtime and are injected as evidence that directly drive the agent's decision-making and report-generation logic.