rombot-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow calls scripts/rombot-ask.py with a user-provided <question>, but the LLM context only receives RomBot’s response (payload["answer"]) which is outsider-authored community text fetched at runtime via HTTP (urllib.request.urlopen), creating an indirect prompt-injection surface if that response is later re-ingested by the agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI sends POST requests at runtime to the configured ROMBOT_CLI_URL (example shown: https://api.rombot.uk/api/community-ask) and prints the returned "answer" verbatim, so remote content directly controls agent output.