alterlab-citation-mgmt

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly directs automated searching and ingestion from public third‑party sources (e.g., search_google_scholar.py for Google Scholar, search_pubmed.py/PubMed E‑utilities, extract_metadata.py which accepts arbitrary URLs and queries CrossRef/arXiv/DataCite), and those results are programmatically parsed and used to drive actions (convert DOIs to BibTeX, auto‑fix/validate entries, deduplicate, select papers), so untrusted public content can materially influence tool behavior and decisions.