cloudflare

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the agent’s LLM context via user-provided chat messages and tool inputs (e.g., AIChatAgent uses this.messages and streamText(...)), which are not authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill shows runtime MCP integration that registers an external MCP server URL (env.MCP_SERVER_URL / example https://mcp.example.com) and then calls this.mcp.getAITools(...) to fetch tools that are injected into the agent's model context (directly affecting prompts/tool execution), so this external URL is a runtime dependency that can control agent behavior.