cali-social-publish

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In scripts/generate_variants.py, when --source url is used it fetches arbitrary public web page text (requests.get(...).text) and embeds that free-form content directly into the LLM prompt (build_prompt → call_claude), which is a public web content outsider source path enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The generate_variants.py script fetches arbitrary reference URLs at runtime (example shown: https://example.com/article) and then injects the fetched HTML/text into the prompt sent to the Anthropic model, so remote content can directly control the model instructions.