inbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md process explicitly ingests external, untrusted web/email content — e.g., "Process newsletters (AUTO-FILTER MODE)" step reads the newsletter body in full and uses WebFetch to fetch linked pages, and the "regular items" flow fetches and reads arbitrary article URLs and GitHub READMEs — so public third‑party content is read and used to drive actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.85). The skill's runtime WebFetch steps fetch arbitrary inbox URLs (e.g., the queue.json "urls" entries such as https://...) and inject that remote content into the agent's context to drive summarization and follow-up prompts, so external pages can directly influence the agent's instructions.