semantic-model-analyst

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and read raw bytes from an http(s) URL using curl ("If the file is at an http(s) URL, fetch the raw bytes via Bash (curl -s <url>) and read the full output") as a required Step 0 workflow action, meaning it will ingest arbitrary third-party web-hosted content that can materially influence its modeling decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching user-supplied HTTP(S) model files at runtime via curl (e.g., curl -s <url> / https://...), meaning arbitrary remote HTTP(S) content would be retrieved during execution and injected into the agent's context, which can directly control prompts — so any http(s) URL fetched this way is a high-risk runtime dependency.