tech-stack-teardown

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow fetches and parses outsider-authored public website HTML at runtime (Layer 2: curl ... https://www.{domain} in scan_website_source), then incorporates extracted strings into the generated report that is printed/returned to the agent/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script requires a runtime API key (os.environ["GOOSEWORKS_API_KEY"]) and makes live requests to https://app.gooseworks.ai (e.g., POST to /v1/proxy/apify/acts/justa~technology-profiling-engine/runs) which triggers remote Apify actor runs (executing remote code), so this external endpoint is a required runtime dependency that executes code.