data-scraper-agent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md describes a runtime path where scraped outsider-authored web/API content (e.g., HTML/RSS/REST responses from public sources) is converted into item text and then injected into the LLM prompt via ai/pipeline.py’s _build_prompt() (items_text → prompt → ai/client.py generate()), creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The GitHub Actions workflow includes runtime "uses" of external actions (actions/checkout@v4 and actions/setup-python@v5) which the runner fetches and executes as remote code during job execution, creating a dependency on externally-run code (actions/checkout@v4, actions/setup-python@v5).