koda-jetbrains-helper

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md:8-9 and especially SKILL.md:24-25 require using an external web fetch (fetch_url_content/WebFetch) to study information from user-provided URLs at runtime, and those fetched pages can contain outsider-authored free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires fetching external pages at runtime ("обязательно самостоятельно изучай информацию по URL" at SKILL.md:24) so URLs such as https://docs.google.com/document/d/1wU6SM3A067Kiq_gokhXbASt34Ro0XvF4unU46edSoBk/edit?tab=t.0#heading=h.9v09lq1rydt4 will be fetched and their content injected into the agent context, which can directly control prompts.