tech-sensemaking

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Phase 1 explicitly scrapes a user-supplied URL at runtime (public web content), and that scraped page text becomes readable prose in {announcement_summary} injected into the LLM context, which is outsider-authored free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly scrapes whatever announcement URL the user supplies at runtime (via "Firecrawl, WebFetch, or browser tools") and injects the fetched page text into the agent prompts, so any user-supplied announcement URL (i.e., the remote URL provided in the "Announcement" field) can directly control agent instructions.