doc2qra

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the skill accepts arbitrary URLs (cli.distill --url which calls fetch_url from url_handler) and feeds the fetched third‑party page text into LLM prompts for summarization and QRA generation, letting untrusted web/user‑generated content directly influence LLM outputs and downstream actions like storage, persona routing, and embedding/proposals.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill calls fetch_url(url) at runtime (see distill() using --url e.g. https://example.com/article) and then injects the fetched text into LLM prompts (QRA_PROMPT.format(text=...)/batch/llm flows), so arbitrary remote page content can directly control the model's instructions/output.