building-agents-with-eve

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In Teaching mode, the required workflow fetches lesson markdown from the public Vercel Academy content API (GET https://vercel.com/academy/building-agents-with-eve/<lesson-slug>.md), which is outsider-authored free text that is then followed/ingested into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Teaching Mode explicitly fetches lesson markdown at runtime from the Academy (e.g. GET https://vercel.com/academy/building-agents-with-eve/.md and the lesson URLs like https://vercel.com/academy/building-agents-with-eve/scaffold-the-dispatcher.md), and those fetched .md files contain an block that the agent is told to follow, so remote content directly controls prompts/instructions at runtime.