curiosity-engine

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text can enter the LLM context via the CURATE worker/reviewer prompts that include vault extraction bodies (user-ingested vault/ files are untrusted and wrapped in <!-- BEGIN FETCHED CONTENT -->), which the orchestrator then reads and sends to the model as new_text/page text for generation and review.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs users to run a git clone of the remote repo (https://github.com/benjsmith/curiosity-engine) to restore missing scripts and the update flow (git pull / setup.sh) fetches and executes code from that repo at runtime, which allows remote code to be executed.