seo-content-brief

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill’s required workflow runs web-research tools (e.g., tavily/search-assistant, tavily/extract, and exa/search) at runtime, which fetch and extract content from public outsider web pages and then feed that extracted prose/metadata into the agent’s LLM context—an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires and invokes the inference.sh "belt" CLI at runtime (e.g., "belt app run ..."), which runs remote apps on https://inference.sh that execute remote code and control prompts/assistant behavior, so https://inference.sh is a runtime dependency that can directly control agent instructions.