storm-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow includes “Inspect up to five sources” and then each lens executor “Retrieve sources within the framed topic’s access boundaries,” ingesting retrieved source text (which can be outsider-authored if the user supplies/permits those identifiers), so the workflow can read attacker-controlled free text depending on provided URLs/sources.