featurebench-benchmarking-agentic-coding

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via the “Classify test imports as targets vs. utilities” step, where an LLM prompt is built from imported symbol names extracted from F2P test files; those test files are sourced from the selected repository (i.e., third-party/open-source code) and thus constitute outsider-authored text that the runtime pipeline reads and feeds into the classifier prompt.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches and executes external project code during runtime (e.g., cloning and running tests on the httpx repository: https://github.com/encode/httpx and installing packages via PyPI/pip), so remote code is retrieved and executed as a required dependency for the pipeline.