instantly-autoreply

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill clearly ingests untrusted third-party content—campaign KB rows from a Google Sheet (lookup_knowledge_base) and lead conversation history from the Instantly API (get_conversation_history)—and passes that content into Claude to generate and send replies, so malicious or user-generated text could indirectly inject instructions affecting agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill reads campaign knowledge directly from a Google Sheet at runtime (spreadsheet ID 1QS7MYDm6RUTzzTWoMfX-0G9NzT5EoE2KiCE7iR1DBLM — e.g. https://docs.google.com/spreadsheets/d/1QS7MYDm6RUTzzTWoMfX-0G9NzT5EoE2KiCE7iR1DBLM) and injects that content into the Claude prompt, so the external sheet content directly controls the model's instructions.