research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is fetched at runtime from public sources (e.g., Hacker News story comments via fetch_hn.py → hacker-news.md, and arbitrary web pages via fetch_url.py → url_*.md) and then written as markdown that the agent later reads into its LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts fetch external content at runtime (notably the GitHub API at https://api.github.com used by fetch_github.py to retrieve README content and arbitrary URLs passed to fetch_url.py like https://... which are fetched and written into research files that the agent then ingests), so remote content can be injected into the agent context and thus could directly control prompts or influence behavior.