cloudflare

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Skill runtime path is the Agents SDK/AI integration where the agent ingests user-provided chat/email/WebSocket text (e.g., onChatMessage/onMessage/onEmail calling streamText with this.messages), which is outsider-authored free text from the end user rather than the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill registers and queries an external MCP server at runtime (env.MCP_SERVER_URL, e.g. https://mcp.example.com) via this.mcp.registerServer / this.mcp.getAITools, causing externally-hosted tool descriptors to be fetched and injected into the agent's tools/messages and thus directly influencing prompts/instructions.