autonomous-agent-harness

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow’s required runtime includes an “Autonomous PR Reviewer” cron that checks for new PRs on watched repos and then reviews changes and posts comments via the GitHub MCP, which means outsider-authored PR text is ingested at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP server config runs npx to fetch and execute external npm packages at runtime—specifically "@anthropic/memory-mcp-server", "@anthropic/scheduled-tasks-mcp-server", and "@anthropic/computer-use-mcp-server"—which executes remote code and is required by the skill.