general-fair-data-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow explicitly loads and extracts free text from the user-provided manuscript PDF (including the Data Availability Statement) and then resolves any DOIs/URLs it finds; if those artifacts are authored by outsiders (e.g., a third-party manuscript/repo), that outsider-authored prose is ingested into the agent’s LLM context via the “Read the PDF text directly” and “resolve any DOIs or URLs found” steps.