trader-alerts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow fetches stock quotes from Yahoo Finance and Stooq, which serve external market data that could theoretically contain prompt injection if compromised, but this represents active fetching of selected URLs rather than uninvited outsider submission.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill fetches delayed market quotes from Yahoo Finance and Stooq via HTTPS URLs defined in the script, which constitute common unofficial operational endpoints without verifiable package signatures or enterprise provenance.