basecamp-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow can read Basecamp project data (e.g., via BASECAMP_GET_PROJECTS, BASECAMP_GET_MESSAGE, BASECAMP_GET_BUCKETS_TODOSETS_TODOLISTS, etc.), and those API responses may include outsider-authored free text (messages, task/to-do content, descriptions) that the agent would ingest into LLM context for subsequent reasoning.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires adding the MCP endpoint https://rube.app/mcp (used at runtime to fetch tool schemas and manage connections via RUBE_SEARCH_TOOLS / RUBE_MANAGE_CONNECTIONS), meaning remote content from that URL directly controls the agent's available tools and runtime behavior.