ml-autoresearch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The loop’s runtime LLM context can include outsider-authored free text when <literature> = on: the literature-search subagent reads public paper full text/snippets via <lit> fulltext/<lit> snippet (and may fall back to WebFetch) and then returns that extracted text/claims to the orchestrator, which the agent uses to plan the next change.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill invokes the literature tool ( = <lit_skill_dir>/tools/lit_search.py) which at runtime WebFetches fulltext HTML/PDF URLs (e.g., arXiv HTML URLs like https://arxiv.org/abs/...) and uses the fetched paper text to generate findings that directly drive the agent's next-change prompts/decisions, so external URLs (arXiv/Semantic Scholar/OpenAlex result URLs) are fetched and can control the agent flow.