autonomous-agent-harness

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly instructs autonomous crons and agents to fetch and act on user-generated third-party content—e.g., "Autonomous PR Reviewer" and cron examples that check and review GitHub PRs, use Exa searches, and the "Computer Use" MCP for browser automation to navigate public web UIs—which the agent is expected to read and then take actions (post comments, create issues, run fixes), enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime MCP server configuration runs npx to fetch-and-execute remote npm packages (e.g., npx -y @anthropic/memory-mcp-server, npx -y @anthropic/scheduled-tasks-mcp-server, npx -y @anthropic/computer-use-mcp-server), which pulls and executes external code the agent requires at runtime.