reddit-voc

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow fetches Reddit search results and selected post comments (outsider-authored free text) via fetch_reddit.py and then reads/writes that raw comment/post bodies into thread-*.json for the synthesis step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The fetch script calls the ScrapeCreators API at runtime (BASE = "https://api.scrapecreators.com") and the returned JSON is then injected into the agent's synthesis step, so external data from https://api.scrapecreators.com directly controls the model's inputs.