canary-watch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime workflow monitors a user-supplied deployed URL (e.g., https://myapp.com) and ingests the page’s readable content/console/network/performance signals into the LLM context, which can include outsider-authored free text from that public web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly loads target sites at runtime (e.g., https://myapp.com and https://staging.myapp.com) to collect console errors and performance metrics, which causes those sites' JavaScript to execute in the monitoring browser context, so the external URLs are runtime dependencies that can execute remote code.