research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Step 4 (“Run research rounds”) spawns the Research Subagent which uses the user-controlled search query to read Obsidian vault notes and Readwise/NLM library/feed documents (including user-inserted content in those systems) into LLM-scored candidate metadata/summaries.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly shallow-clones and processes user-provided GitHub repositories at runtime (e.g., "https://github.com/owner/repo" / "github:///@<commit_sha>" / "https://github.com///tree/<commit_sha>"), which fetches remote repository content that is then read and used to generate prompts/docs for downstream subagents (high risk of remote content influencing agent behavior).