clone-website

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md requires using the Playwright MCP to navigate to and scrape an arbitrary target URL (e.g., "Navigate to the target URL with browser_navigate" and numerous browser_evaluate/asset-download scripts) and then uses that live, user-specified website content to generate specs and dispatch builder agents, so untrusted third-party page content is ingested and can directly influence subsequent tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flag the user-supplied target site URL (the URL passed to browser_navigate / $ARGUMENTS) because the skill fetches the live site's HTML/assets at runtime and injects that extracted content verbatim into component spec files which are then inlined into builder-agent prompts, meaning remote site content directly controls agent instructions.