project-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The workflow explicitly says "If no guide: WebSearch '[language] project setup best practices'", and the skill also fetches third‑party install scripts (e.g., curl https://astral.sh/uv/install.sh), which requires reading and executing content from the open web and thus exposes the agent to untrusted third‑party content.