agent-native-architecture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly instructs agents to perform web searches and fetch arbitrary URLs—see references/architecture-patterns.md and references/from-primitives-to-domain-tools.md (WebTools.webSearch(), web_fetch()) and the tool design template in references/mcp-tool-design.md (call_api / fetch URL)—so untrusted public webpages would be read and used to drive agent decisions and tool calls.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly advocates granting agents atomic primitives such as a "bash" tool and file read/write plus self-modification capabilities, which enable the agent to modify system files, code, and potentially escalate privileges even though it doesn't explicitly mention sudo or user creation.