spring-ai

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the skill explicitly describes ingesting and using public third‑party content (e.g., JsoupDocumentReader for HTML in references/rag-advisors.md, the QuestionAnswerAdvisor / RetrievalAugmentationAdvisor RAG pipeline in SKILL.md, and MCP client configuration that consumes external MCP servers), which are untrusted sources that get appended into prompts and can materially influence model behavior and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP STDIO example will run npx to fetch and execute the npm package @anthropic/mcp-server-brave-search at runtime (seen in spring.ai.mcp.client.stdio.servers.brave-search.command=npx and args=-y,@anthropic/mcp-server-brave-search), which downloads/executes remote code and provides external MCP tools/resources/prompts that directly control agent behavior.