literature-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's core workflow explicitly requires fetching and ingesting open/public third-party content (e.g., "gget search pubmed", "gget search biorxiv", direct arXiv API, Semantic Scholar API, and even Google Scholar scraping" in Phase 2) and mandates that the agent read/interpret titles/abstracts/full texts and use those materials to drive screening, synthesis, prioritization, and downstream actions, which clearly exposes the agent to untrusted, user-generated web content that could carry indirect prompt-injection instructions.