sports-team-player-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The agent queries Flashscore entity search and news feeds via Crawlora API endpoints, which return public web sports content and third-party news headlines authored by outside publishers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill makes runtime HTTP requests to the third-party Crawlora API endpoint hosted at api.crawlora.net to retrieve sports dossier data.