opensearch-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests arbitrary web content (e.g., CLI reference: "uv run python scripts/opensearch_ops.py load-sample --type url --value https://example.com/data.json" and the Document Processing guide: converter.convert("https://example.com/report.pdf")), which the agent is expected to parse/index and use for search/agentic decisions, exposing it to untrusted third-party content that could carry indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's MCP configuration auto-starts an external MCP server using "fastmcp run https://knowledge-mcp.global.api.aws", which is invoked at runtime as a required dependency and therefore fetches and executes remote code from that URL.