blog-google

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). The runtime workflow for this skill ingests outsider-authored free text from Google API responses (e.g., PageSpeed Insights/CrUX/GSC/NLP return fields like audit titles/descriptions, query strings, URL inspection messages, and NLP entity names/sentiment interpretations) which are then embedded into the agent’s context via the scripts’ JSON/printed outputs and later into report HTML/PDF; these strings are not authored by the operating user.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill instructs the user to run a privileged system install ("sudo apt install libpango1.0-dev libcairo2-dev"), which requests altering machine state with root privileges even though most other commands are project-local and non-privileged.