discover-talent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill calls the public TMDB API (see discover_talent/tmdb_client.py and SKILL.md) to fetch person details, biographies, movie credits, and images from open, user-contributed sources and then parses that content (e.g., biographies and known-for genres) to derive taxonomy/bridge tags and to influence ranking and downstream decisions (create-cast), so untrusted third-party content can materially affect tool behavior.