claim-entity

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests and caches content from arbitrary public URLs (see references to ClaimRecord.source_url and the workspace-conventions.md sources/{url-hash}.json entries, fetched via "webfetch" or "cobrowse_interactive") and an LLM-based verification step reads that fetched "content" to detect deviations and drive status transitions and propagation, so untrusted third-party content can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches claimant-provided source_url values at runtime (e.g., https://example.com/ai-report) and uses the fetched content as source excerpts for LLM-based deviation detection, which means external content is injected into the model prompt/context and can directly influence agent behavior.