web-read

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes: for the “read” workflow, the agent can pass an arbitrary outsider-supplied URL, the hosted pagewatch service fetches outsider-authored page content and returns it as readable JSON field body["markdown"], which web_read.py prints to stdout (and thus the agent would ingest it into LLM context to summarize).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime HTTP calls to the hosted pagewatch service at https://pagelens.dev (BASE_URL) and uses JSON responses (e.g., human_message and verification_uri_complete) to produce/verbatim relayable instructions and links to a human, so the external content directly controls agent prompts.