google-finance-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow retrieves Google Finance quotes, financial data, and market news via Crawlora API endpoints, where news and analyst articles can contain third-party text fetched based on active search or instrument selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill makes runtime API calls to Crawlora at api.crawlora.net, which constitutes an inbound operational dependency with common unofficial third-party provenance.