list-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). scripts/classify-batch.ts and scripts/multi-lane-classify.ts ingest first-party prompt text plus provider/user-supplied company evidence (row.text_excerpt/description and optionally scraped homepage text via fetchHomepageText from row.domain) into OpenAI chat completions, so if an outsider can poison those candidate rows (e.g., via extra_candidates CSV) they can indirectly inject free text into the runtime LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches arbitrary company homepages at runtime (e.g., via grab()/fetchHomepageText using URLs like https://${domain} and http://${domain}) and injects that remote HTML/text directly into LLM prompts used for judging/classification, so external site content can control model inputs.