cross-review-project

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path includes send_task/poll_tasks exchanging review_bundle and response payloads through the cross-review-mcp broker; those payloads are authored by the peer (an outsider relative to the operating user) and are ingested into the agent’s LLM context when the agent polls tasks and reads the findings JSON.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to read an external protocol resource ("cross-review://protocol") — a markdown document that informs and constrains the agent's review behavior — which is a runtime-fetched document that directly controls prompts/instructions.