mandex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime “mx pull” downloads third-party documentation packages from the CDN/registry and “mx search/show” reads their markdown text into the local SQLite index and returns it to the agent, which is outsider-authored free text (public CDN content) that can be included in the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill fetches documentation packages (and an ONNX reranker model) at runtime from the public endpoints (e.g., https://cdn.mandex.dev and https://api.mandex.dev), and those fetched docs can be injected into agent prompts (and the ONNX model is downloaded and executed locally for reranking), so external content can directly influence prompts/behavior.