ask

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly auto-discovers and fetches untrusted public content (Brave/Perplexity web results, YouTube transcripts, ArXiv, blogs, RSS, etc.) as described in SKILL.md's Auto-Learn flow and implemented in dogpile_parse.py, consult.py (discover_persona/retrieve_context), ingest-youtube integration, and extract_store.run_extractor_qra — it ingests that user-generated/open-web content into memory and then reads and synthesizes from it (including building persona system prompts), so third-party content can materially influence actions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly fetches external web content at runtime—e.g., YouTube transcript URLs like https://www.youtube.com/watch?v=-ewfP4BC7RA are ingested by the learn/ingest_youtube/fetcher pipeline and that fetched text is injected into persona/system prompts (retrieve_context / build_persona_prompts), so remote content can directly influence model instructions.