web-clone

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime path: scripts/recon-site.mjs uses Playwright to load the user-supplied --url and then extracts readable DOM text/HTML-derived strings (e.g., document.title, sections[].text, headings, metaDescription, cssVariables, fonts) into the generated *-recon.json, which the agent can then include in its LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime scripts (recon-site.mjs, mirror-site.mjs, interaction-probe.mjs, network-capture.mjs, route-crawl.mjs, etc.) navigate to and fetch a user-supplied target URL (e.g., --url https:///, examples like https://chiuhans111.github.io/marbles/) and load that site's JavaScript/WASM inside a Playwright browser context, which means arbitrary remote code from those external URLs is executed at runtime and the skill depends on that content for its operation.