whale-hunting

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md and script explicitly state it fetches public market data — a "crude scan (Yahoo Finance)" and a "precise drill-down (Massive API)" (with a required MASSIVE_API_KEY or fallback to Yahoo), so the agent ingests untrusted third‑party web/API content which it reads and uses to drive detection and downstream decisions.