crw-self-host

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow for crw-mcp/crw-server involves scraping/searching user-supplied URLs/queries at runtime, which causes the agent to ingest arbitrary outsider-authored page text (public web content) into the LLM context via the tool’s extraction/summarization outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly includes an install command that pipes a remote script to the shell ("curl -fsSL https://fastcrw.com/install | CRW_BINARY=crw sh"), which fetches and immediately executes remote code at install/runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill includes explicit install steps that run privileged commands and write system files (e.g. piping an install script to sh and using sudo to write /usr/share/keyrings and /etc/apt/sources.list.d), which instruct modifying the host system state and require elevated privileges.