kagi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow can ingest outsider-authored free text from public web content when using commands like kagi extract "https://example.com/article" or kagi search ... --follow N, where the tool fetches and converts third-party page text into LLM-readable output (e.g., --format toon/markdown).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly accepts and fetches user URLs at runtime (e.g., kagi extract "https://example.com/article" and kagi ask-page "https://example.com/article"), and the retrieved page content is fed into summarization/assistant flows, meaning remote content can directly control prompts/LLM input (risk of prompt-injection or malicious content).