aris-infra

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill directly fetches public third‑party content (e.g., tools/arxiv_fetch.py that queries/downloads papers from arxiv.org and referenced Semantic Scholar fetch tools) and integrates external LLM reviewer MCP servers (mcp-servers/llm-chat, gemini-review, claude-review) which the SKILL.md workflows (e.g., /aris-idea-discovery, /aris-research-pipeline) explicitly ingest and use to drive decisions, so untrusted web/LLM content can materially influence tool use and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). During runtime the MCP servers call external LLM APIs (e.g. https://api.openai.com/v1, https://generativelanguage.googleapis.com/v1beta/models/... and https://api.minimax.io/v1) to fetch reviewer responses that are injected/returned to the agent and directly influence its prompts/instructions as a required part of the ARIS review workflow.