xcode-and-ios-simulator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow (SKILL.md) explicitly supports performing an "openUrl" action (e.g., type=openUrl,url=...) and then using element-tree and perform commands to inspect and interact with the resulting UI, meaning the agent can fetch and interpret arbitrary public web pages or third‑party content and let that content influence subsequent actions.