cloudflare

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The only outsider-authored free text ingested at runtime is user/client input sent to an Agents SDK agent via onMessage/onEmail/onRequest/websocket or chat (e.g., WSMessage.text, email.text), and the agent then streams/uses it as part of the LLM prompt/messages; however the required workflow itself is not shown reading any arbitrary third-party text source without a specific user-submitted payload.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Agents SDK shows runtime registration of an MCP server and fetching of AI tools (this.mcp.registerServer / this.mcp.getAITools) which will load tool definitions from the external MCP URL provided in config (https://mcp.example.com) and inject them into the model context, so runtime-fetched content can directly control prompts/tooling.