agent-bootstrap

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow reads agent.toml from the local repository root and installs remote skills from specified sources or registries, which can ingest third-party content if external registries or raw URLs point to outsider-authored files.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains an operational example showing the execution of an unverified remote curl fetch (https://gitea.example.com/.../raw/.../skill-name/SKILL.md), which constitutes an unverifiable runtime external dependency under weak/unknown provenance.