openaccountants-us-ca

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The runtime path loads outsider-authored free text: get_skill({ slug }) fetches authoritative markdown from the OpenAccountants MCP server (i.e., documents authored by a third-party organization), which is then ingested into the agent’s LLM context under “Apply the rules.”

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent at runtime to call the OpenAccountants MCP endpoints (e.g., the openaccountants MCP server / openaccountants.com) to fetch authoritative markdown via start(...) and get_skill(...), and that fetched content is explicitly required and injected into the agent's responses, so the external OpenAccountants endpoint controls prompts and execution flow.