zara-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The agent queries product descriptions, categories, and search results from the Crawlora API (Zara catalog), which contains untrusted third-party product marketing text and descriptions authored by external entities.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill makes runtime HTTP requests to the Crawlora API at api.crawlora.net, which is an external commercial third-party service rather than an official publisher component, resulting in a common unofficial operational dependency.