evaluation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to use WebSearch to read public model cards (e.g., HuggingFace) and external docs (see references/model-card-research.md and SKILL.md) and to curl/download files from those pages, and it directly uses extracted settings (deployment.extra_args, pre_cmd, reasoning toggles, interceptor configs) to drive tool use and deployment—exposing the agent to untrusted third-party content that can influence actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs adding a runtime pre_cmd that uses curl to download a reasoning parser from HuggingFace (example: https://huggingface.co/.../reasoning_parser.py), which would fetch remote code used by the deployment (potentially executed and/or altering prompt/reasoning behavior), so this is a runtime external dependency that can control prompts or execute code.