graphify

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via the semantic extraction subagents: Step 3 Part B dispatches an Agent for each chunk that reads the user-provided corpus files (docs/papers/images) and asks the LLM to extract entities/relations from their contents; if those files were authored by outsiders (e.g., downloaded webpages/arXiv/PDFs or other people’s text), that free text is ingested into the subagent prompt.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). High-confidence: the skill explicitly clones GitHub URLs at runtime (e.g. "https://github.com//" via Step 0) and supports ingesting arbitrary URLs via ingest('URL') in /graphify add, and those fetched files are passed verbatim into subagent prompts (the FILE_LIST in the extraction subagent), so remote content can directly control prompts and influence execution.