wjs-converting-wp-to-hugo

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime LLM context is fed from the user-provided WXR .xml and uploads/ content: scripts/wxr_to_hugo.py reads the XML (open(xml_path).read()), parses <content:encoded> HTML into Markdown, and that converted prose (including outsider-authored post/page body text) is then used downstream; this is outsider free text originating from the WordPress site export.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions workflow fetches and installs a remote Hugo binary at runtime via wget from https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb and invokes external actions (actions/checkout@v4, actions/configure-pages@v5, actions/upload-pages-artifact@v3, actions/deploy-pages@v4), all of which run code fetched at workflow time and are required for the build/deploy pipeline.