design-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly asks for a "Target URL" (Phase 2: Gather context) and then uses new_session, inspect_page, and act (Phase 3: Analyze) to load and programmatically analyze pages at that URL, thereby fetching and ingesting arbitrary public web content that could be untrusted.