bkd

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill routinely fetches and processes user-provided issue content and logs from a reachable BKD server (e.g., GET /projects/{projectId}/issues/{issueId}/logs/filter and POST /projects/{projectId}/issues/{issueId}/follow-up in references/orchestration.md and references/rest-api.md), which are untrusted/user-generated and are read/interpreted to drive actions (follow-ups, starting executions, status changes), creating a clear indirect prompt-injection vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The BKD API endpoint referenced as $BKD_URL (e.g. http://host:port/api or http://your-host:port/api) is invoked at runtime (multiple curl examples: follow-up, PATCH to "working", cron actions) to deliver prompts and trigger executions/cron jobs on the remote BKD server, so the fetched/triggered content can directly control agent prompts and execute remote work.