aps

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches and ingests content from public third-party sources—Semantic Scholar (S2) and OpenAlex (OA) and downloadable PDFs (including Sci-Hub-configured URLs)—as shown in SKILL.md commands like aps s2 search, aps oa search, aps s2 snippets, aps lib read (which auto-downloads papers) and aps lib dl, meaning the agent will read and act on arbitrary external paper/text content that could contain injected instructions.