paper-siphon

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly accepts and fetches remote PDF URLs (e.g., "INPUT: Path to a local PDF file, or a URL pointing directly to a PDF" and examples like https://arxiv.org/pdf/...), and its required workflow says to "Read the resulting Markdown file to answer questions or summarize," meaning the agent will ingest and act on untrusted, public third‑party content that could contain instructions influencing subsequent actions.