openaccountants-us-mi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow loads “authoritative markdown” via get_skill({ slug }) from the OpenAccountants MCP server; this is third-party, outsider-authored reference content that becomes LLM-readable prose in the agent’s context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill explicitly requires calling the OpenAccountants MCP server at runtime (start() and get_skill()) to fetch authoritative markdown that is then injected and used as the agent's instructions — e.g. the referenced site https://openaccountants.com — so remote content directly controls prompts.