web-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). SKILL.md and rules/when-to-use.md explicitly instruct the agent to call x402 endpoints (e.g., https://enrichx402.com/api/firecrawl/scrape and https://enrichx402.com/api/exa/contents and /exa/search) to fetch, scrape, and extract text from arbitrary public URLs which the agent is expected to read and synthesize, creating a clear vector for indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to enrichx402 APIs (e.g., https://enrichx402.com/api/exa/contents and https://enrichx402.com/api/firecrawl/scrape) to fetch arbitrary webpage content which is then injected into the agent's context and used to drive its outputs, meaning the fetched content can directly control prompts and the skill depends on these endpoints.