heretic

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt explicitly confines the agent to use only the title and abstract, then later instructs "Now read the full paper" (an instruction that contradicts/overrides the earlier constraint), which is a hidden/deceptive override of the skill's stated scope and thus a prompt-injection-style instruction.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow ingests the target paper’s full text at runtime (“Now read the full paper”), and that paper’s body text is outsider-authored free-form prose (the authors’ manuscript), which the agent would feed into the LLM context for comparison/scoring.