bm25

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can be ingested when the corpus spec is github.com/owner/repo[@ref]: resolve_corpus() downloads an unvetted tarball at runtime, discover_files() reads its files as UTF-8 text, and CorpusIndex.build() tokenizes/indexes that text into the LLM-visible snippets/output context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script performs a runtime download from the GitHub API (https://api.github.com/repos/{owner}/{repo}/tarball/{ref}) and extracts the repository contents which are then indexed and surfaced as search snippets (i.e., injected into the agent context), so the fetched remote content can directly control agent output.