outbound-triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In Outbound Triage, step 1–2 (“Read the target issue or issue list” and “Inspect…comments, plan document, description, acceptance criteria…”) requires the agent to ingest free-text fields from outsider-authored Paperclip issue/comment content at runtime, since those fields can be posted by untrusted users into the Paperclip control plane.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill documentation instructs running remote npm packages at runtime (e.g., "npm install -g paperclipai" and "npx -y @bbengamin/paperclip-mcp-server"), which would fetch and execute third‑party code and thus are runtime external dependencies that execute remote code.