data-jp
Warn
Audited by Snyk on Jun 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.72). At runtime,
data-jp/scripts/pack.pyingests JSON fields returned by outsider-controlled public web sources (e.g.,yfinance_client.py→ Yahoo Finance scrapedinfo/financials,tdnet_client.py→ Yanoshin TDnet index,boj_client.py/estat_client.py/ecb_client.py→ public API responses) and passes those readable strings/numbers into the agent’s LLM context via the structured JSON payload; this is indirect prompt-injection exposure because those payloads can contain arbitrary text (e.g., company names/titles/error strings) that downstream LLM steps may quote or summarize.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata