paper-reader

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly downloads papers from public arXiv URLs ("Arxiv link" step uses curl to fetch https://arxiv.org/pdf/.pdf) and then mandates extracting and automatically reading/parsing the PDF text and figures (extract_text.py, extract_figures.py and a haiku subagent to OCR/interpret figures) as required inputs that directly drive writing, verification, and tool actions, so untrusted third-party content from arXiv/other fetched PDFs can influence the agent's behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly runs at runtime: python3 -c "import fitz" 2>/dev/null || pip3 install pymupdf which fetches and installs the PyMuPDF package from PyPI (https://pypi.org/project/PyMuPDF), thereby downloading and executing remote code that the extraction scripts (extract_text.py / extract_figures.py) require.