box

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is ingested when the skill clones a runtime-specified repo URL and then the Search stage summarizes local files from that cloned repository (directly in direct mode by the main thread, or indirectly in delegated mode by the Search subagent), where that repo’s contents are written by third parties.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Prepare stage runs git clone/pull on a user-provided repo URL at runtime and then the Search stage reads and injects files from that cloned repo into model outputs (e.g., sample URLs shown: github.com/john-doe/abc), so a runtime external repo URL controls the agent's prompts/content.