vercel-sandbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the runtime path screenshotUrl(url: string) uses sandbox.runCommand("agent-browser", ["open", url]) and then ingests page-derived free text indirectly via get title --json / screenshot --json on an attacker-supplied url.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly runs sudo dnf install and sudo ldconfig (and global npm installs) inside the sandbox, instructing the agent to execute elevated system-level commands that modify the VM's system state.