jina-read-url

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required workflow takes a user-supplied public URL, fetches its page content via scripts/read_url.py using https://r.jina.ai/ (public web content authored by outsiders), and then injects the returned Markdown text into the agent’s LLM context for summarization/answering.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill calls Jina Reader at runtime (https://r.jina.ai/) to fetch Markdown for arbitrary public URLs and explicitly instructs the agent to "answer only from the returned content," so content served via https://r.jina.ai/ can directly control the agent's prompts/behavior.