data-extractor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill ingests untrusted user-generated images (uploaded via the web UI /api/upload-image and passed to the Claude vision calls in web/server.py — notably detect_plots and extract_image_region which send image_base64 to Claude/digitize_figure) and the model's parsed output is directly used to determine plot regions and extraction actions, so content in those images can indirectly inject instructions that alter processing.