website-spec

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime “Full site audit” workflow fetches and inspects the user-supplied target URL(s) (via browser tools/curl/view-source), so the LLM context can include outsider-authored free text from arbitrary third-party web pages’ HTML/body content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The spec explicitly describes and expects agents to fetch /.well-known/agent-skills/index.json and then load remote SKILL.md files (e.g. /.well-known/agent-skills//SKILL.md) at runtime, and those fetched Markdown skills directly supply instructions that can control an agent's prompts/behavior.