macos-computer-use

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow starts with computer_use(action="capture", mode="som", app="Safari"), which ingests a screenshot plus an AX-tree index of the current Safari page/UI; if that page contains outsider-authored free text (e.g., arbitrary web content), it becomes LLM-readable context via the capture output.