airweave

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches user- and app-generated content from Airweave collections via the scripts/search.py POST to {base_url}/collections/{collection_id}/search and SKILL.md/EXAMPLES.md instruct the agent to read and synthesize Slack/GitHub/Notion/Jira/etc. content (displayed from each result's textual_representation and used to generate completions), so untrusted third‑party content is ingested and can directly influence agent outputs and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime search script calls the external API endpoint https://api.airweave.ai/collections/{collection_id}/search (used at runtime via the AIRWEAVE_BASE_URL default) and by default consumes the API's "completion" field as the generated answer, meaning remote content from that URL directly controls the agent's output and the skill requires the API (AIRWEAVE_API_KEY and AIRWEAVE_COLLECTION_ID) to run.