social-quality-auditor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). The skill’s runtime workflow ingests “the draft batch + latest analytics exports” and may also read keyless public listening/participation telemetry via connectors (e.g., tavily.py, gdelt.py, discourse.py, hn.py, bluesky.py/fediverse.py), which can include outsider-authored free-form text (public web pages/posts/comments) that is then placed into the LLM context for scoring/veto checks.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's standalone fallback explicitly fetches required runbook/reference files at runtime from https://raw.githubusercontent.com/aaron-he-zhu/aaron-marketing-skills/main/references/, and those fetched documents are required to control scoring, veto rules, and agent behavior (the skill says "Do not score without the runbook"), so this is a runtime external dependency that directly controls the agent's instructions.