collaborate-in-revise

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In “Read before acting,” the agent uses the Revise MCP tools to read the live document content (“Read the live document…”) before making edits, so outsider-authored text inside a shared Revise document can be ingested at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly declares and uses the Revise MCP runtime endpoint https://mcp.revise.io/mcp (in both SKILL.md and agents/openai.yaml) as the live tool server whose names/schemas the agent must follow, so this external URL is used at runtime and can directly control the agent's prompts/behavior.