hunt-dispatch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Step 1 (fingerprint) and step 2 load path uses curl to fetch landing-page HTML and banners from outsider-controlled target hosts and then LLM-relevant framework markers are extracted from those response bodies at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime curl requests to target-controlled URLs (e.g., "https://$H$P" and "https://$H"/"https://$TARGET/api/me") whose fetched responses are parsed and used to decide which platform/skills to load, meaning external content directly controls agent behavior at runtime.