institutional-flow-tracker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, scripts/track_institutional_flow.py and scripts/analyze_single_stock.py fetch outsider-authored free-text fields (e.g., institution/holder names in holder and company names in companyName) from the public FMP API endpoints /institutional-holder/{symbol} and /profile/{symbol}, then interpolate those strings into the generated markdown/LLM context (e.g., report += f"... {top_holder[:30]} ..." and `report += f"### {r['symbol']}
• {r['company_name']}"`).