graphify

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In Part B semantic extraction, the required workflow uses the Agent tool to read and extract entities from chunked outsider-provided file contents (docs/papers/images) created by detection over the user-supplied path/GitHub URLs/added URLs, so attacker-authored free text in those files is directly ingested by the LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill clearly fetches external repositories and arbitrary URLs at runtime (e.g., it treats paths like https://github.com// as GitHub URLs to clone and it calls ingest('URL') to download user-supplied content), and those fetched files are then passed verbatim into the semantic subagents' prompts for LLM extraction—meaning remote content can directly influence agent instructions and outputs (flagging https://github.com// as an example).