account-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The QBR pre‑paration checklist in references/qbr-template.md explicitly tells the agent to "Research customer's recent business news (earnings, press releases, hirings)", which requires ingesting public third‑party web content that could influence the agent's agenda and actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill's companion-check instructs the agent to run shell commands (ls) and to offer installing companion skills via npx, which can change the host (install packages/execute code), so it encourages state-changing actions though it does not request sudo, system-file edits, or user creation.