api-state

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s Step 2–3 runtime path uses mcp__Ref__ref_read_url (or mcp__context7__query-docs / WebFetch) to fetch primary documentation and changelog text from external sources, which is outsider-authored free-form content ingested into the LLM context for extraction and citation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime fetching of primary docs and raw changelogs via mcp__Ref__ref_read_url and a WebFetch fallback for raw GitHub URLs (e.g., https://raw.githubusercontent.com/.../CHANGELOG.md), and that fetched content is injected into the agent's context and used to drive its analysis, so these external URLs directly control prompts and are required.