qveris

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md requires calling qveris_search/qveris_inspect/qveris_execute, whose runtime responses include provider description, examples.sample_parameters, and potentially truncated_content/full payload text from the QVeris marketplace and upstream providers—i.e., outsider-authored free text is ingested into the agent context via the tool/API response.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch the signed "full_content_file_url" at runtime and "use the full payload" (SKILL.md:87), which means externally-hosted JSON would be retrieved and injected into the agent's context, so I flag the runtime dependency on that URL (field "full_content_file_url").