detection-engineering-coverage-evaluation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill ingests outsider-authored free text by extracting content from an attacker-provided URL or directly from the user’s raw text input in Step 1 (“Extract Threat Intelligence”) and then feeds the extracted content into generate_threat_detection_opportunity in Step 2.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching arbitrary user-supplied URLs at runtime ("If the input message contains a URL, use the available web fetching tool or capability to retrieve the HTML or raw text content from that URL"), and that fetched content is injected into the model context to generate TDOs, so remote content can directly control prompts.