flowchad-runner

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Outsider-authored free text can reach the LLM only indirectly via step expect/errors coming from repo-authored flow YAML and status/comments generated from runtime browser interactions, not from an external outsider-controlled text stream the agent passively monitors or must first “select” from a queue/feed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runtime performs a git clone of the target repository using "https://github.com/${REPO}.git", and the checked-out .flowchad/config.yml and flow YAMLs are read at runtime and directly drive the agent's step-by-step instructions, so this remote URL is a runtime dependency that controls agent behavior.