harvard-artifacts-collection-analytics-pipeline

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill fetches artifact metadata and captions from the Harvard Art Museums API, which contains third-party contributor content and user-facing text ingested without prior selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill clones a personal GitHub repository (https://github.com/Manali0711/Harvard-Artifacts-Collection-Data-Engineering-Analytics-App.git) to install and run the project code, representing an unofficial operational dependency with weak provenance.