page-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested at runtime from the current webpage’s DOM (arbitrary third-party page content) which the in-page agent reads as text and includes in the LLM prompt for instruction-following.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's Path 1 demo injects and executes remote JavaScript at runtime from https://cdn.jsdelivr.net/npm/page-agent@1.8.0/dist/iife/page-agent.demo.js (also used by the bookmarklet), which runs code in the page and relies on Alibaba's demo proxy — a required runtime external dependency that executes remote code.