zooclaw-managed-agents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, outsider-authored free text can enter ZooClaw only via the integrator’s own calls to createSession(...initial_events) and postEvents(... user.message/system.message content/text), and then the agent’s reply is read back from the durable event stream via streamEvents(...)/assistantText(ev) and assistantText(ev) concatenation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs show an agent-declared MCP server URL ('https://mcp.example.com/mcp') that the agent calls at runtime as a remote tool endpoint (mcp) which executes external code/logic, so this is a runtime external dependency that can control execution.