mood-music

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required Step 1 calls scripts/get_genres.html which fetches live genre data from the third-party endpoint https://soundtracks.loudly.com/api/ai/genres and "feeds the list directly back to the LLM" (per scripts/get_genres.html and SKILL.md), so external, untrusted content is read and used to decide genres and subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime scripts (scripts/get_genres.html and scripts/index.html) make required fetch calls to https://soundtracks.loudly.com/api/ai/genres (and to https://soundtracks.loudly.com/api/ai/songs) which return data that is fed back into the LLM to control prompt decisions and the generation flow, so external content directly controls agent behavior at runtime.