expanso

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow includes deploying a skill from the public “skills.expanso.io” marketplace via a CLI URL, meaning the LLM/runtime would ingest the pipeline text/config returned from that outside source at deploy time (outsider-authored free text via public web content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README/instructions include commands that fetch-and-execute remote scripts (curl -fsSL https://get.expanso.io/edge/install.sh | bash and curl -fsSL https://get.expanso.io/cli/install.sh | sh) and a deployment command that pulls a remote pipeline definition (https://skills.expanso.io/text-summarize/pipeline-cli.yaml) which would directly control runtime behavior, so these external URLs can execute code or control agent pipelines.