local-vault

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). REQUIRED runtime path: scripts/sync.py → enrich_frontmatter() → shells out claude -p with head/tail taken from the tool-generated Markdown that includes content extracted from outsider-authored raw files in KB_SOURCE_DIR (e.g., PDFs/Office docs/images uploaded by others), so arbitrary free text from those files can be fed into the LLM context for enrichment.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). At runtime the skill calls the MinerU API (https://mineru.net/api/v4) to upload files and download converted full.md content which is then written into the vault and read by the LLM, meaning remote content fetched from that URL can directly influence agent prompts/outputs.