pidgin-share

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md describes an "Interactive responses" flow where served HTML can call window.pidgin.respond(payload) (served to arbitrary web visitors) and the skill explicitly polls /v1/channels//wait (via the provided /scripts/pidgin wait command) and instructs "On responded, act on payload", so untrusted third-party JSON from public visitors is ingested and can directly influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime polls the pidgin API (e.g. https://api.pidgin.sh/v1/channels//wait) and explicitly instructs the agent to "act on payload" returned there, meaning remote content fetched at runtime can directly control the agent's behavior.