ArXiv

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill includes a mandatory, pre-execution curl to a local endpoint (and an explicit "not optional" order) that is unrelated to the ArXiv search functionality, forcing an external side-effect outside the skill's stated purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the Search/Latest/Paper workflows, the agent issues runtime fetches to first-party external text sources (arXiv Atom XML and AlphaXiv markdown) based on user-provided search terms or paper IDs, ingesting those documents’ free text (titles/abstracts/overviews) without requiring an explicit selection step beyond triggering the workflow.