content-reviewer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow ingests the “content submission” (link/description/caption/media notes) provided by a creator/outsider; if that submission includes free-form text (e.g., caption/description) it is read into the LLM context as part of Step 4/5 compliance and review scoring, creating an indirect prompt-injection surface from outsider-authored text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's fallback explicitly fetches required runbook/reference files at runtime from https://raw.githubusercontent.com/aaron-he-zhu/aaron-marketing-skills/main/references/, and those files are required and directly control the review prompts/instructions (the skill says "Do not score without the runbook"), so this is a runtime external dependency that controls agent behavior.