aris-serverless-modal

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). Yes — SKILL.md explicitly downloads and loads models from public model hubs (e.g., AutoModel.from_pretrained("meta-llama/Llama-3.2-1B") in Pattern B and MODEL = "Qwen/Qwen3-4B" with vLLM download in Pattern C), so the skill fetches untrusted third‑party artifacts from public repositories and uses their outputs in runtime workflows, which could contain instructions that materially influence subsequent behavior.