openwebui

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs include direct install scripts from an unvetted domain, a placeholder/unknown GitHub repo, and an unofficial model/mirror domain — patterns commonly used to distribute malicious binaries or scripts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Open WebUI’s required workflow supports agentic web search where a model can call fetch_url to fetch and extract full page text from attacker-controlled URLs into the model context, enabling indirect prompt injection via outsider-authored web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The agentic-search docs instruct users to "Download the Action" from https://openwebui.com/posts/65d97417-d079-4720-b2cc-a63dd59b7e3e — this is a remote Function Action (code) that is fetched and then imported/enabled to run inside the system at runtime to fetch web content and inject it into model context, so external code/content can directly control model prompts.