ai

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow can ingest outsider-authored free text via provider- or tool-generated message content (e.g., model responses and tool results streamed back into the agent context through agent.run(...) / ai.stream(...)), which originates from external parties like the public model provider and/or remote tools rather than the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime calls that fetch and load remote tools — e.g., ai.mcp.get_http_tools("https://mcp.example.com/mcp") which retrieves tool definitions that directly control agent behavior (and the ai.mcp.get_stdio_tools("npx", ..., "@anthropic/mcp-server-filesystem", ...) example runs npx to fetch/execute remote code) — so external content can control prompts or execute code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The prompt documents tools that can perform filesystem-modifying actions (e.g., a delete_file tool and MCP filesystem tools) which enable the agent to change the host state; although approvals are mentioned and no explicit sudo/privilege-escalation or user-creation instructions are present, the included examples still allow potentially harmful state changes.