aip-user-stories

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In post-implementation mode, the required workflow fetches outsider-authored free text from public sources at runtime—specifically the AIP URL via WebFetch and GitHub PR metadata/body via gh pr view ... --json title,body,files—and then ingests that prose into the agent’s LLM context for analysis and generation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches AIP and PR content at runtime from URLs such as https://cwiki.apache.org/confluence/... and https://github.com/apache/airflow/pull/... and uses that fetched content as the required input that directly controls the agent's prompts/instructions for generating the playbook.