aris-novelty-check

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Phase B explicitly directs the agent to perform WebSearch of public sites (arXiv, Google Scholar, Semantic Scholar) and WebFetch abstracts/related-work, and Phase C instructs embedding those third-party papers into prompts to the reviewer model—meaning untrusted web content is fetched, read, and can influence tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Phase B/Phase C explicitly performs WebSearch/WebFetch at runtime to retrieve paper abstracts from sites like https://arxiv.org, https://scholar.google.com, and https://www.semanticscholar.org and injects those fetched contents into the prompt sent to the external reviewer model (mcp__codex__codex), so remote content can directly control the agent's instructions.