community-signals

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—at runtime the required workflow fetches outsider-authored free text from public forums (Hacker News comments/stories via Algolia in hn_search() and Reddit post titles/bodies via the Apify actor in reddit_search_apify()), then writes that text into CSV fields (text, title, about) which the skill later reads for the LLM briefing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script starts a remote Apify actor via the Gooseworks proxy at https://app.gooseworks.ai (APIFY_BASE) during runtime (req.post to APIFY runs), which executes remote code on Apify and is used for Reddit scraping.