growth-record-strategy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Growth-record-strategy reads existing Paperclip issues/comments/plan documents (including fetched referenced “wiki source material”) from the Paperclip control plane via the CLI/MCP surfaces as part of “Inspect current Paperclip goals, projects, candidate parent issues, plan documents, and related comments,” so outsider-authored free text submitted into those Paperclip records can be ingested without first selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The docs instruct running "npx -y @bbengamin/paperclip-mcp-server", which fetches and executes a remote npm package at runtime and is referenced as the MCP fallback dependency, so it is a runtime external dependency that executes remote code.