baoyu-danger-gemini-web

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill ingests outsider-authored free text from Gemini’s HTTP response: scripts/main.ts → GeminiClient.generate_content() → res.text() → extract_json_from_response(txt) → parses candidate[1,0] into Candidate.text, which is then returned/printed and thus fed into the agent’s LLM context as output text.