upgrade-plugin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly performs WebFetch/WebSearch against public sites (e.g., "WebFetch: https://github.com/anthropics/claude-code/releases", "WebFetch: https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md", and dynamic discovery of docs via WebSearch/site:docs.anthropic.com) and instructs the agent to read and act on those findings to drive upgrade decisions, so untrusted third‑party content can materially influence tool use and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly performs runtime WebFetch of external documentation/raw content (e.g., https://raw.githubusercontent.com/anthropics/claude-code/main/CHANGELOG.md and https://docs.anthropic.com/en/docs/claude-code/overview), and that fetched content is used to drive the agent's research outputs and upgrade instructions, so these URLs are runtime dependencies that directly influence agent prompts.