academic-pipeline

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via the runtime-fetched content path used by deep-research (Stage 1) and by integrity_verification_agent/claim_ref_alignment_audit_agent when they retrieve cited reference full text from the public web; those fetched pages/excerpts are then passed into downstream LLM steps for synthesis/verification, creating an indirect prompt-injection exposure surface.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's claim_ref_alignment_audit_agent fetches cited reference full texts at runtime (via DOI resolution / publisher endpoints such as https://doi.org/ and retrieval APIs like the Semantic Scholar API) and injects the retrieved excerpt directly into the judge prompt, so external URLs are used live to control prompt inputs.