content-publisher

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to fetch and scrape public third-party sites (e.g., apify.actor("apify/firecrawl-scraper", { urls: [https://news.ycombinator.com/?q=${topic}] })) and to navigate/populate editors on external platforms (medium.com, substack), meaning untrusted, user-generated web content is ingested and used to drive content generation and publishing decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's required MCP servers are started at runtime via npx (e.g., "npx -y @apify/mcp-server", "npx -y @makenotion/mcp-server", "npx -y @modelcontextprotocol/server-slack"), which fetch and execute remote code from the npm registry (e.g., registry.npmjs.org) and are required dependencies for the skill.