paprika-make

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow spawns background subagents (via assets.md) that execute cURL commands against external model APIs (Poly Haven, ambientCG, Poly Pizza, Sketchfab, OpenGameArt, itch.io) whose returned text metadata and descriptions are ingested by the agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The asset search and discovery steps (assets.md) use explicit cURL commands pointing to external APIs (Poly Haven, ambientCG, Poly Pizza) to retrieve operational content, classified as a common/reputable unofficial dependency.