docs-seeker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow fetches and ingests arbitrary outsider-authored free text from public documentation pages listed in an outsider-provided llms.txt (via WebSearch/WebFetch and then Explorer agents reading those URLs), which can include malicious prompt-injection content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly performs runtime WebFetch of llms.txt files (e.g., https://docs.astro.build/llms.txt, https://nextjs.org/llms.txt) and uses their contents to decide which URLs to process and to instruct Explorer/Researcher agents, and it also clones GitHub repositories at runtime (e.g., https://github.com/org/library) for Repomix analysis — so external content fetched during runtime directly controls agent behavior.