rag-implementation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's HTMLLoader explicitly fetches arbitrary HTTP URLs via requests.get(source) in the ingestion pipeline, and those fetched page contents are inserted into retrieved chunks and the system prompt (build_rag_prompt), meaning untrusted third-party web content can be read and directly influence model prompts and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The HTMLLoader calls requests.get(source, timeout=30) for any http(s) source and the fetched content is later injected into the LLM system prompt via build_rag_prompt, so any external HTTP(S) URL provided at runtime (i.e., URLs fetched by HTMLLoader via requests.get(...)) can directly control prompts.