design

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s Phase 1/2 workflow calls the manage_catalog MCP tool to list components and fetch detailed module metadata (including underlying Terraform source via CATALOG_OPERATION_GET_COMPONENT_IAC / gitSource), so outsider-influenced free text could be ingested if the attacker can cause catalog contents/templates returned to contain malicious instructions that the agent then reads at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to construct and use GitHub module source URIs (e.g., "github.com/GoogleCloudPlatform/terraform-google-cloud-run//modules/v2?ref=v0.33.0") which Terraform will fetch during runtime (via terraform init/plan), so remote GitHub module code is retrieved and executed as a required dependency.