hosted-agents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via runtime client messages (e.g., Slack/Web/Chrome chat content) that the system forwards into the sandbox/agent prompt; those messages are authored by non-operating users and are not chosen by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime code examples perform git clones like "git clone https://x-access-token:{token}@github.com/{repo_url}" and then run install/build commands (npm install, npm run build), which fetch external GitHub repository content at runtime and execute that code inside sandboxes.