setup-engine

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly runs WebSearch and "fetch and extract" steps to read official migration guides, changelogs, and other public web documentation (see steps 3, 7, and 10 in SKILL.md), and it uses that fetched third-party content to populate reference docs and drive agent behavior, which could allow indirect prompt injection from untrusted web pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly performs WebSearch and fetches official engine documentation at runtime (e.g., https://docs.godotengine.org/, https://docs.unity3d.com/, https://docs.unrealengine.com/) and uses the fetched content to populate agent-facing reference docs and update agent instructions, thereby feeding external content into the agents' prompt/context.