autoskill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text from the user’s screen/OCR is ingested via the local screenpipe HTTP API (scripts/fetch_window.py → item["content"]["text"] / window_name), then redacted and embedded into the LLM prompt (scripts/run.py → scripts/synthesize.py::_build_prompt), creating an indirect prompt-injection surface from arbitrary on-screen content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill, when configured to use cloud backends, makes runtime POSTs to the Anthropics API (https://api.anthropic.com) — and to any user-supplied Foundry gateway (e.g. https://foundry.example.com/anthropic) — and it parses the LLM JSON responses to decide verdicts and to produce SKILL.md content, so those remote endpoints' responses directly control the agent's output at runtime.