brainstorm

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The skill explicitly instructs the agent to "silently ignore" a user-provided flag and "Do not emit any warning or error about this flag," which is a hidden/deceptive behavior that conceals the system's actions from the user.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In Step 2, the Web Agent runs at runtime and fetches external documentation via mcp__context7__query-docs and potentially WebSearch/WebFetch, where outsider-authored web/registry text can be ingested based on the user’s feature description without selecting a specific trusted item first.