agent-canvas-environment

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via the delegated conversation’s initial_message.content.text (the PROMPT), which is user-provided free-form text that the skill forwards into POST /api/conversations and the agent-server then feeds to the LLM; this is not sanitized/controlled by the skill.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill performs runtime requests to the local backend (e.g., GET http://localhost:8001/api/settings) and then forwards the returned agent_settings (including the Fernet-encrypted llm.api_key and agent_context) into POST /api/conversations to create delegated agents, meaning the fetched content is used at runtime to control the delegated agent's configuration and tools.