deep-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the agent to search and ingest open web sources (Step 3: "firecrawl_search", "web_search_exa") and to fetch full page content (Step 4: "firecrawl_scrape(url...)", "crawling_exa(url...)") including blogs and forums, so the agent will read and act on untrusted third-party content that can influence its conclusions and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches arbitrary external pages at runtime (e.g., firecrawl_scrape(url: "") and crawling_exa(url: "")) and injects their contents into the agent context to drive prompts and final outputs, so external content fetched from those URLs can directly control the agent's behavior.