heygen-avatar

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md and references/asset-routing.md explicitly instruct the agent to fetch and web_fetch publicly accessible URLs (HTML pages, public files, user-provided image/video URLs and preview_audio_url) and to "extract 3-5 most important points" and contextualize them into prompts/scripts, which means the agent will read and act on arbitrary third-party public content that could carry injected instructions.