sales-spree

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md instructs the agent to read references/learnings.md at the start of each invocation, and that file explicitly states it was populated from live web research (spreecommerce.org/docs and GitHub) and includes free-form summarized content, which is then ingested into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly directs agents to fetch and use external agent skills and docs at runtime—e.g., installing/using the agent skills repo (github.com/spree/agent-skills) via an install command and adding the docs MCP connector (https://spreecommerce.org/docs/mcp)—which will execute/ingest remote code/content that can directly control agent prompts and behavior.