upgrade-dependencies

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow’s runtime text ingestion is limited to the project’s own files/CLI outputs and uses web-search for changelogs/migration guides; that web-search fetches public web content (outsider-authored free text) which is then read by the agent to inform upgrades, creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires using the web-search skill to fetch external migration guides and changelogs at runtime (various external migration-guide/changelog URLs retrieved via web-search — see ../web-search/SKILL.md), and those fetched pages are used to directly control the upgrade prompts and decisions.