arxiv

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches public arXiv content (via the arXiv API and ar5iv.org HTML/PDF downloads shown in SKILL.md, download.py, and extraction.py) and then extracts and interprets that paper text into Q&A and memory storage, so untrusted third‑party paper content can directly influence decisions and subsequent tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill downloads ar5iv HTML at runtime (e.g., https://ar5iv.org/abs/ via download_html/download_paper) and the fetched paper text is injected into LLM prompts (see qa_extraction._extract_qa_via_scillm), so remote content from https://ar5iv.org can directly control the model's prompt/context during execution.