metro-ai-apps-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). references/DISCOVERY.md instructs the orchestrator to fetch and read skill SKILL.md/metadata from GitHub (live discovery/index refresh via raw URLs and gh API) as part of runtime flow when the catalog is stale or ambiguous, so outsider-authored free text can be ingested.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The orchestrator's DISCOVERY.md shows runtime curl calls that fetch live skill metadata and SKILL.md content from raw.githubusercontent.com and api.github.com (e.g. https://raw.githubusercontent.com/open-edge-platform/skills/main/skills-config.json and https://raw.githubusercontent.com/open-edge-platform/skills/main/.agents/skills//SKILL.md), and that fetched content is read at runtime to decide/reroute which delegate skill to invoke, so remote content directly controls the agent's behavior.