managing-docker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's instructions explicitly fetch and run third‑party models and web UIs from public registries — e.g., "docker model pull ai/gemma3:..." and the Open WebUI compose example (ghcr.io/open-webui/open-webui:main) in references/AI-WASM.md — meaning the agent will ingest and act on untrusted, user-supplied model/web content (via DMR/OpenWebUI endpoints) that could influence tool use or next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs pulling and running external models at runtime (e.g., "docker model pull ai/gemma3:4B-Q4_K_M"), which downloads remote model content that is executed locally and directly controls model prompts/responses.