duckdb-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly shows fetching remote, public files (e.g., INSTALL httpfs; SELECT * FROM 'https://example.com/data.parquet' and read_parquet('s3://bucket/data.parquet')), so the agent can ingest and act on arbitrary untrusted web/S3-hosted content that could indirectly inject instructions.