company-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—during Step 3/4 the workflow uses node {SKILL_DIR}/scripts/extract_page.mjs "<url>" to fetch and parse outsider-authored public web page content (TITLE/META/BODY) and then that extracted free text is used by the agent to synthesize and write research/CSV/HTML, which becomes part of the agent’s LLM context.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the user/agent to permanently modify ~/.claude/settings.json to auto-grant Bash permissions and to batch commands to minimize/avoid permission prompts, which encourages bypassing the platform's security prompts and altering permission configuration (even though it doesn't request sudo or create users).