capture-alphapai-unified

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow retrieves financial research reports, commentary, roadshow transcripts, and user-submitted queries via the AlphaPai API and Web service, which can contain untrusted external text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The script scripts/setup.sh executes pip install requests from PyPI without an immutable digest or version pinning, creating an unverified runtime external dependency with medium provenance risk.