app-store-review-arbitrage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow fetches outsider-authored free text from public app stores: App Store customer review bodies and Google Play review content are scraped/loaded by scripts/fetch_reviews.py and then ingested into the agent via {tmpdir}/asr-raw.json → low_star_reviews for LLM clustering/copy generation (indirect prompt injection risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime fetch script pulls live review and metadata content that is injected into the agent's analysis prompts — specifically Apple endpoints like https://itunes.apple.com/lookup?id={app_id} and the iTunes RSS feed URL (https://itunes.apple.com/{country}/rss/customerreviews/page={page}/id={app_id}/sortBy=mostRecent/json), and it also uses the google-play-scraper package to fetch Google Play data; because these remote responses are loaded at runtime and directly drive the LLM's instructions/output, they meet the criteria for a runtime external dependency that controls prompts.