appstoreprice-hub

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflow (SKILL.md and scripts/api.js) explicitly fetches and parses data from the public site appstoreprice.org (via signed REST API calls and RSC page fetches executed with minis-browser-use), so the agent ingests untrusted third‑party web content which is then parsed and directly used to drive search, ranking, and price-based recommendations.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). This skill navigates to and executes code from https://appstoreprice.org at runtime (it requires the page's webpack module 52661 via self.webpackChunk_N_E to obtain a signing function and uses it to call the site APIs), so it executes external site-provided code and relies on that content as a required dependency.