openaccountants-us-fl

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runtime workflow loads outsider-authored markdown from the OpenAccountants MCP server via get_skill({ slug }), and that markdown is ingested as LLM-readable prose to drive answers (public/third-party skill content not authored by the operating user).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly requires runtime calls to the OpenAccountants MCP server (e.g., https://openaccountants.com) via start(...) and get_skill(...) which return authoritative markdown that the agent must load and use as the controlling prompt/instructions, so external content directly controls the agent at runtime.