positioning

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). In Phase 1, the skill asks the user for “a website, pitch deck, or memo” (URLs/file paths) and then reads/extracts their product description and messaging; if that URL/document is authored by an outsider, its free-form text is ingested into the LLM context via the runtime document-reading/extraction path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly states "If the user provides a file path or URL: Read it" and uses that fetched content to populate research prompts and questions, so any user-provided external URL (i.e., "user-provided URL" / arbitrary external URL supplied at runtime) would directly control the agent's prompts.