chroma-hybrid-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can enter the LLM context via scripts/search.py → kb_reader.py reading cold-notes/raw.jsonl (read_cold_notes builds text from JSONL content), and then search.py returns that text as retrieved context for the agent; this JSONL is written by scripts/write_cold.py from conversation-derived --content/--topic fields that are not guaranteed to be authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls huggingface_hub.hf_hub_download at runtime to fetch the ONNX model artifacts "intfloat/multilingual-e5-small" and "BAAI/bge-reranker-base", which are then loaded and executed by onnxruntime (remote model binaries fetched at runtime and used for inference), so these external repos control runtime behavior.