background-removal

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow sends user-supplied image URLs to inference.sh apps (BiRefNet, Reve) and consumes the resulting image, so outsider text is exposed only if the user selects an arbitrary URL, which fits the low tier.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The setup banner instructs installing a skill from the GitHub-style repository belt-sh/cli, which is installed skill material, but the skill does not establish that belt-sh is the first-party publisher of the inference.sh CLI, so it is an unverified third-party source with no concrete warning signs (medium).