nemo-retriever

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text can enter the LLM context via retriever query results: the CLI returns extracted text from user-provided PDFs/images/HTML/etc. (e.g., retriever query ... | tee /tmp/hits.json then the agent reads /tmp/hits.json and uses hit['text'] to form the reply), and that extracted prose originates from documents the operating user did not author.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install recipe can clone and pip-install code at runtime from https://github.com/NVIDIA/NeMo-Retriever.git (and pulls PyTorch wheels via https://download.pytorch.org/whl/cu130), which fetches and executes remote code during setup and is required for the retriever CLI to run.