prospecting

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The demand-signal branch in FIRST-CUSTOMERS.md has the agent mine forum threads, public social posts, product reviews, and GitHub issues (per the Step 2 signal buckets and Step 3 source list), and SIGNALS.md has it monitor community comments through social-listening tools, so outsider-authored text reaches the agent through the required workflow, including any GitHub issue reading, which the rubric rates medium.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The decisive boundary is SKILL.md's instruction to read linked skill files "from the linked source" when not installed locally, which makes Quegenx/agent-skills content operational instructions; the repository's publisher is not established as an enterprise or foundation, so it is common/reputable unofficial and the tier is medium.