copycat-scout

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the skill consumes outsider-provided free-text as --query/--input (parsed into origin["query"]) and immediately uses it to drive HTTP fetches and page/JSON extraction from Apple/Google storefronts (e.g., search()/related() in apple_store.py and get()/script parsing in google_play.py), so the discovered third-party page text can be ingested before any user selection.