google-account-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill's workflow and scripts (see SKILL.md "Complete" step and the "Triage System Instructions" section, plus scripts/sync-emails) explicitly fetch untriaged Gmail messages and feed email content into the agent's triage/system prompt for analysis, meaning untrusted, user-generated email content can be interpreted and materially influence agent decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime scripts call the configured CLAUDE_ASSIST_SERVER (default http://localhost:2529) endpoints such as http://localhost:2529/api/google/accounts/ to store/fetch the email_triage_instructions field, which the docs state "gets injected directly into Haiku's system prompt" — i.e., remote content from that URL directly controls agent prompts at runtime.