codex-marketing-skills

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's "YouTube Researcher" (skills/youtube-researcher in SKILL.md) explicitly fetches public YouTube search results via serpapi.com and transcripts from api.supadata.ai — user-generated, untrusted content that the agent reads and analyzes to "ground AI responses in creator style" and drive downstream actions like content generation and scheduling, which could allow indirect prompt injection.