knowledge-base

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly supports ingesting arbitrary URLs (see SKILL.md and scripts/bulk-ingest.js) and scripts/ingest.js's fetchUrl fetches and scrapes public HTTP/HTTPS pages (via fetch/curl), stores their text in the local KB, and query.js uses those indexed chunks to drive search results — meaning untrusted third-party web content is read and can materially influence agent outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/ingest.js fetches arbitrary user-supplied HTTP(S) URLs at runtime (via fetch(url) and fallback curl -sL "${url}" in scripts/ingest.js), and the retrieved HTML is stored and later injected into the knowledge-base/search results (i.e., the model context), so remote content can directly influence agent prompts/responses.