lit-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly mandates "Web search is mandatory" and directs the agent to fetch and parse open/public sources (e.g., "Semantic Scholar API via WebFetch", site:arxiv.org, openreview.net and citation pages) which the agent is expected to read and use to make decisions (tiering, following citations, invoking /paper-read), exposing it to untrusted third-party content that could carry indirect prompt injection.