outbound-prospecting-engine

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime, the workflow explicitly runs outsider-authored web/social signal skills (e.g., job-posting-intent, funding-signal-monitor, linkedin-post-research/linkedin-commenter-extractor, luma-event-attendees, eightfold-customer-finder) which fetch/parse public pages or user-generated LinkedIn/Luma content into “Raw signal list” that is then used for personalization and campaign setup.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installation command "npx goose-skills install outbound-prospecting-engine" fetches and executes a remote npm package at install/runtime (pulling code from the npm registry), so it is a runtime external dependency capable of executing remote code.