talisman

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Phase 2 (“Research the real content”) requires reading the codebase’s files (e.g., schema/migrations/docs) and using their text to write chapters, so any outsider-authored repository content would be ingested as free-form prose into the agent’s LLM context during runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README explicitly instructs cloning the remote skill repository (git clone https://github.com/atexy4ba/talisman-skill.git), which at runtime would fetch SKILL.md/AGENTS.md (agent instructions) that directly control agent behavior and thus is a runtime external dependency that can alter prompts.