pi-web-ui

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests arbitrary public URLs (e.g., loadAttachment("https://example.com/doc.pdf") and createExtractDocumentTool which fetches document URLs, with CORS-proxy fallback) and then converts extracted text/attachments into LLM input via defaultConvertToLlm and tool outputs, so untrusted third-party content can directly influence the agent's decisions and tool usage.