web-docs-to-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow explicitly instructs the agent to fetch and crawl arbitrary public documentation URLs (e.g., "webfetch --format markdown" in Step 1/3 and the scripts/extract-links.sh use of browser-use eval), so the agent ingests untrusted third‑party web content that can directly influence how it builds and uses the generated skill.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches and injects arbitrary external documentation at runtime using commands like "webfetch " and "browser-use open " (and associated browser-use eval calls), and then synthesizes that fetched content into a SKILL (agent instructions), so remote content can directly control prompts/instructions.