cloudflare

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include user-controlled R2 bucket endpoints (personal file hosting) and a Git URL embedding a token — both are high-risk patterns for distributing arbitrary/executable files or leaking credentials, which attackers commonly abuse to deliver malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The agents SDK runtime ingests outsider-authored free text from inbound chat/WebSocket “onMessage” payloads and email bodies (e.g., await email.text()), which can be supplied by non-trusted users into the agent before the model runs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill registers an external MCP server at runtime and fetches AI tools (which control agent tools/prompts) using the URL "https://mcp.example.com", so remote content from that URL can directly influence agent behavior.