openaccountants-us-nj

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The runtime workflow loads “authoritative markdown (rates, brackets, deductions, audit flash points, citations)” via get_skill({ slug }) from the OpenAccountants MCP server; this is third-party, outsider-authored free text that is ingested into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to call the OpenAccountants MCP server (openaccountants.com / "openaccountants" MCP) at runtime using start() and get_skill() to fetch authoritative markdown that is then used verbatim to drive responses, so external content directly controls prompts.