project-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The script fetches package contents and views versions from npm registry and git repositories, which can contain outsider-authored text when evaluating external packages or dependencies.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The script fetches a remote tarball via urllib.request.urlopen using a URL derived from npm view, representing an unauthenticated third-party registry transport without enforced integrity digest verification, categorizing it as a weak runtime external dependency.