capability-evolver

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via Hub-provided task payloads/events: in loop mode with EVOMAP_PROXY=1/A2A_TRANSPORT=mailbox, the agent reads inbound mailbox messages (e.g., task_available, hub_event, asset_submit_result) that originate from EvoMap Hub/other nodes, and those message contents are incorporated into the generated GEP prompt sent to the LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The code calls the Hub at runtime (POST to {A2A_HUB_URL}/a2a/skill/store/<skill_id>/download — default A2A_HUB_URL=https://evomap.ai) to fetch skill bundles which are written into skills/, and those downloaded files can contain executable JS or behavior that the agent dynamically detects/uses, so remote content from https://evomap.ai can directly change prompts/behavior or introduce executable code.