read-ocr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes OCRing user-supplied URLs/files and then extracting result.full_text from the provider’s JSON response; that recognized text is free-form content originating from an outsider-controlled source (e.g., a user-provided URL/image/PDF), which would be fed into the agent context when presented to the user.