citation-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the required workflow can ingest outsider-authored free text by scraping/reading Google Scholar search results and exporting them for metadata extraction (e.g., via search_google_scholar.py then extract_metadata.py --input ...), where attackers can poison publicly visible results the agent consumes.