keystatic-astro

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Keystatic/Astro content is loaded at runtime from on-disk Git-tracked files under src/content/ via the Astro Content Layer (getEntry/getCollection/render using loader(glob)), and those files can include outsider-authored text (e.g., CMS editors) that becomes LLM-readable MDX/frontmatter.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.75). The skill explicitly instructs the agent to query external documentation at runtime (e.g., the Astro MCP search endpoint https://mcp.docs.astro.build/ and to fetch Keystatic docs from https://keystatic.com/docs) so remote content would be injected into the agent context and directly influence its prompts/behavior.