auto-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Phase 2 "Parallel Research" (in SKILL.md) and the sub-agent prompt in references/research-strategies.md explicitly require spawning web-searching sub-agents that WebSearch/WebFetch public URLs (docs, GitHub, blogs, forums), and those fetched third-party pages are read, quoted, and used to drive rewrites and autonomous eval-loop decisions, exposing the agent to untrusted user-generated web content that can influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Phase 2 requires spawning parallel sub-agents that perform WebSearch/WebFetch at runtime and "quote verbatim" authoritative pages (e.g. https://docs.claude.com, https://anthropic.com/engineering, https://github.com/anthropics/skills), and those fetched pages are explicitly incorporated into the model's findings and used to drive rewrites/eval instructions—so remote URLs are fetched at runtime and directly control prompts/instructions.