cloudflare

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Agents SDK “Task Queue” workflow shows onRequest() enqueueing work and processQueue() dequeuing up to 10 tasks, where the task data (derived from request JSON) is then fed into processVideo()—so any outsider that can POST to the queue/endpoint that produces queue items can indirectly supply free text that the agent later ingests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill registers an external MCP server at runtime (env.MCP_SERVER_URL → https://mcp.example.com) and then calls this.mcp.getAITools(...) and passes those tools into model completions, meaning remote content from https://mcp.example.com can directly control the agent's toolset/prompts.