microsoft-agent-framework

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). References describe AG-UI and DevUI HTTP/SSE endpoints where the application exchanges user-supplied text at runtime (e.g., input() in the AG-UI client example and input= in the DevUI API example), meaning outsider-authored free text can be fed into the agent without selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime MCP tool examples that fetch tool/agent definitions from external MCP servers (e.g., HostedMCPTool / MCPStreamableHTTPTool using "https://learn.microsoft.com/api/mcp" and a GitHub MCP at "https://api.github.com/mcp"), which the agent would call at runtime and whose responses can control agent behavior and tool execution.