google-signin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow reads outsider-authored free text only when a user’s browser submits credential (a Google-signed ID token) and associated fields to POST /api/auth/google, but this content is constrained to the Google ID-token format and is verified against Google JWKS before any use, with no browsing/queue/feed ingestion path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill loads and executes the remote Google Identity Services script at runtime (https://accounts.google.com/gsi/client), which is a required external JS dependency that runs code in the client to control the sign-in UI/flow.