idea-discovery

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill contains an explicit instruction to perform silent file-write retries without asking the user for permission ("Do NOT ask the user for permission — just do it silently."), which is a deceptive directive that contradicts the workflow's checkpoint/approval behavior and falls outside normal, transparent operation.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—Phase 0.5/Phase 1/Phase 3/Phase 4 describe fetching and extracting content from external sources (e.g., arXiv/Google Scholar/Semantic Scholar and “other URL” via WebFetch) and then using that extracted text as LLM context for sub-skills like /research-lit, /novelty-check, and /research-review, which is outsider-authored free text at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches an arXiv paper at runtime (example: https://arxiv.org/abs/2406.04329) via the /arxiv download/WebFetch flow and injects the fetched paper summary into prompts as context, so external content can directly control model instructions.