agentic-workflows

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill’s required runtime workflow loads repository overlay and matched prompt/skill files from github/gh-aw (e.g., .github/aw/instructions.md and other .github/aw/*.md), which are outsider-authored free-text documents not authored by the operating user, and that text is ingested into the agent’s LLM context via the “load these files”/“load it with … after loading” paths.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly directs the agent at runtime to "Load these files from github/gh-aw (they are not available locally)" and then to "load the matching workflow prompt/skill" and follow it directly, meaning remote repository content from github/gh-aw will be fetched and will directly control prompts/instructions; flagged URL: github/gh-aw