docker-sandbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill can pull public Docker images and fetch/install packages or other remote resources when network is enabled (see "target Docker image must be available locally or pullable by Docker" and the example using "python -m pip install -r requirements.txt ... --allow-net"), and the container's stdout/stderr are returned to the agent in JSON, so untrusted third‑party content from public registries/websites can be read and materially influence subsequent actions.