pm-url2proto

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—Step 2 “Capture and clone” uses runtime Chrome automation (mcp__Claude_in_Chrome__read_page / mcp__Claude_in_Chrome__javascript_tool) and/or WebFetch to ingest outsider-authored page text/HTML/accessibility-tree content into the agent’s context for reconstruction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly navigates to and fetches user-provided web pages at runtime (e.g., https://stripe.com/payments, https://linear.app, https://vercel.com/dashboard) and uses the retrieved page HTML/accessibility tree and JS-extraction results to drive prompt/context and generate code, so these external URLs directly influence the agent's runtime behavior.