openaccountants-us-ma

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runtime path loads outsider-authored markdown from the OpenAccountants MCP server via get_skill({ slug }), and that markdown is ingested as LLM-readable prose to “apply the rules,” which is an indirect prompt-injection exposure from third-party content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires runtime calls to the OpenAccountants MCP server (e.g., https://openaccountants.com) via start(...) and get_skill(...) to fetch authoritative markdown that is then used as the authoritative prompt/instructions for the agent.