asana-automate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text from Asana task content (e.g., task notes/description, comments/stories, custom-field display values) is returned by the MCP tool calls like mcp__asana__get_task and then formatted into Markdown, which the parent agent ingests into its LLM context as natural-language text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill performs runtime calls to the Asana MCP endpoint (mcp.asana.com/v2/mcp via tools like mcp__asana__list_tasks and mcp__asana__get_task) and explicitly incorporates returned task/comments/attachment text into agent prompts, giving clear high-confidence evidence that fetched content can carry prompt-injection payloads that control agent instructions.