parse-cfp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). SKILL.md:32-44 requires fetching CFP pages from a user-supplied URL (public web content) via scripts/fetch_cfp.py, which reads the fetched HTML and prints extracted readable text to stdout (scripts/fetch_cfp.py:298-303) that the agent then uses as LLM context for extraction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes scripts/fetch_cfp.py to GET arbitrary CFP pages at runtime (e.g. https://sigspatial2026.sigspatial.org/research-submission.html) and then uses the fetched page text (including verbatim quotes) to populate the venue profile, so a remote URL directly controls the agent's extracted content.