bluesky-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow calls Crawlora endpoints like /bluesky/author-feed, /bluesky/post-thread, and /bluesky/search-actors to read outsider-authored Bluesky profile/posts/replies via scripts/crawlora.sh and the q, actor, and uri parameters (free-text and identifiers that can be attacker-controlled), so the LLM ingests arbitrary post text from a queue/feed-like external source without an explicit “select trusted item” step.