wjs-publishing-books-to-x

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime workflow reads outsider-authored free text from VoiceDrop public book content via scripts/fetch-book.py (it fetches book.json, intro.html, and chapter HTML for a selected slug, strips HTML, then the contents are ingested into the daily.sh prompt for claude -p).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime fetches book content from https://jianshuo.dev/voicedrop/books (and the JSON index https://jianshuo.dev/voicedrop/books?format=json) via scripts/fetch-book.py and scripts/pick-next-book.sh, and that fetched content is injected into the claude prompt in daily.sh to directly control the generated thread, so these remote URLs materially control agent prompts.