community-signals

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly scrapes and ingests user-generated content from public forums—Hacker News via the Algolia API and Reddit via the Apify trudax/reddit-scraper-lite actor (see SKILL.md Phase 3 and scripts/community_signals.py), and it directly reads and scores those posts/comments to drive enrichment and outreach decisions, so untrusted third-party content can materially influence the agent's actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script starts and polls an Apify actor at runtime (POST to https://api.apify.com/v2/acts/oAuCIx3ItNrs2okjQ/runs and related /actor-runs and /datasets endpoints, or via the gooseworks proxy https://api.gooseworks.ai/v1/proxy/apify) which executes remote actor code and is a required dependency for the Reddit scraping path, so this external URL results in remote code execution at runtime.