broomva-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow for this CLI is to fetch and display “public prompts” (e.g., via broomva prompts list/get/pull), which ingests outsider-authored free-form prompt text from the public web/service into the agent/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI contacts https://broomva.tech (and its API endpoints such as https://broomva.tech/api/auth/api-token) at runtime to fetch prompt content which directly supplies agent instructions, so the external site controls prompts used by the tool.