paper-graph

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is fetched at runtime from public sources (Semantic Scholar/DeepXiv/arXiv) and ingested into the LLM context via the CLI-generated {papers_input} blocks (e.g., fetch_papers → format_papers → LLM steps classify/outline/detail), where paper abstracts and discussion excerpts are included verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes required runtime calls to the Semantic Scholar API (e.g. https://api.semanticscholar.org/graph/v1/paper/search and https://api.semanticscholar.org/graph/v1/paper/{external_id} used by resolve_seed_papers / fetch_papers), and the returned paper metadata (titles/abstracts) are injected into the LLM prompt templates, so this external content directly controls prompts and is a required dependency (S2_API_KEY is mandatory).