flowdeck

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill can load arbitrary public URLs into the simulator (flowdeck ui simulator open-url) and then capture and return screenshots/accessibility trees (flowdeck ui simulator screen --json) — meaning the agent will fetch and read untrusted third-party content (including web pages or user-provided URLs); the skill also supports adding packages from public repos (flowdeck project packages add https://github.com/...) which further exposes untrusted code/content.