local-tools-guide

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). 该技能的“正文提取/候选链接核验/搜索发现”运行路径会对用户提供的 URL 使用 web_fetch 或 browser-use open 读取网页正文（外部网页作者的自由文本进入 LLM 上下文），属于公共 web 内容注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs web_fetch(url="") and browser-use open at runtime (e.g., "web_fetch(url="")" and the example "https://www.google.com/search?q=搜索词"), which fetches arbitrary remote page content and injects that content into the agent's context for downstream instructions/analysis, so remote URLs can directly control prompts.