bdi-mental-states

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime LAG workflow takes external RDF context (user-provided or otherwise supplied) and injects it verbatim into the LLM prompt as {context} (“## Context to Model: {context}”), so if that RDF contains outsider-authored free-text literals (e.g., comments/issue text/web page text) they become readable prose in the LLM context via the prompt.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The BDILogicAugmentedGenerator loads and parses an ontology_path at runtime and serializes/injects that ontology into the LLM prompt—so if that path is an external URL (e.g., https://w3id.org/fossr/ontology/bdi/) the remote content would directly control agent prompts.