plan-submission

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes: the required workflow step “Re-verify the critical dates against the live CFP” runs python3 scripts/fetch_page.py "<cfp_url from the profile>", and fetch_page.py fetches arbitrary public web HTML at runtime, extracts readable text (to_text(...)) and prints it to stdout—so that fetched outsider-authored free text can be ingested into the agent/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs scripts/fetch_page.py at runtime with the profile's live CFP URL (python3 scripts/fetch_page.py "<cfp_url from the profile>"), which fetches arbitrary http(s) pages and returns the page text that is then used to re-verify and drive the generated submission plan, so external page content directly controls the agent's output.