create-persona

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests public, user-generated content (e.g., YouTube URLs via /ingest-youtube and voice training, web search via /dogpile, /discover-books, /discover-movies, and GitHub via /github-search) as shown in SKILL.md and the batch_ingest.py and batch_voice_train.py scripts, and that ingested content is used by /ask learn, voice training, monitoring, and persona synthesis — meaning untrusted third-party content is read and can materially influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). This skill repeatedly downloads and ingests YouTube URLs at runtime (e.g. https://youtube.com/watch?v=abc123) via the ingest-youtube/voice-train pipeline and /ask learn, and those fetched transcripts/audio are injected into persona memory and used to train voices or enrich knowledge — meaning remote content directly influences agent behavior and is relied on by the pipeline.