create-project-agency

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's Phase 3 "Fetch Tech Stack Documentation" step explicitly uses external Context7 MCP tools (resolve-library-id and query-docs) to fetch documentation from public third‑party sources — and even offers a fallback to fetch arbitrary user-provided URLs via WebFetch — which the agent will read and incorporate, exposing it to untrusted third‑party content that could carry indirect prompt injections.