longbridge-invest-analysis-us

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Required workflow runs scripts/fetch_weekly_data.py, which fetches runtime data including outsider-authored free text (e.g., per-symbol news via longbridge news ... --format json) and then the agent uses those fetched JSON/news contents to populate the HTML/Markdown report context (via assets/report_template.html placeholders like {{ai_analysis}} / {{holdings_analysis_sections}}).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The HTML template includes a script tag that fetches and will execute remote JavaScript at runtime from https://unpkg.com/lightweight-charts/dist/lightweight-charts.standalone.production.js, and the skill explicitly requires Lightweight Charts, so the remote code is a required runtime dependency.