modern-web-guidance

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses npx -y modern-web-guidance@latest search "<query>" and retrieve "<id>", which fetches web/registry content at runtime (public npm package + guide retrieval) and then injects the retrieved guide markdown text into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires running an external npm package at runtime via the command "npx -y modern-web-guidance@latest" which fetches and executes remote code (from the npm registry) as a required dependency, so this is a runtime-executed external dependency (npx -y modern-web-guidance@latest).