qa

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md instructs the agent to use a runtime browser tool ($B goto, links, console, snapshot) against a user-supplied/auto-detected target URL, which can cause the agent to ingest outsider-authored page text (public web content or third-party app content) into the LLM context via the browser/read outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup step runs a shell command that downloads and pipes a remote install script to the shell (curl -fsSL https://bun.sh/install | bash), which fetches and executes remote code during runtime.