agent-setup-wizard

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The wizard asks for a “Git URL” and then clones that outsider-provided repository at runtime; the agent scans/copies the repo’s SKILL.md/rule .md files (free text authored by the repo’s publisher) into the LLM-visible context during discovery/verification, enabling indirect prompt injection via those markdown contents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The wizard explicitly clones a user-supplied Git URL at runtime (e.g., a git or https://github.com/... repository) and installs SKILL.md and rule files from that repo into the agent, which directly supply prompts/rules that control agent behavior, so the fetched content can control instructions at runtime.