zep

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow “Load Context for a New Agent Turn” calls GET /api/v2/sessions/<session-id>/memory and then injects the returned context (distilled facts + recent messages) into the agent’s system prompt; that context ultimately originates from prior session messages that can include free-form text authored by the end user (an outsider relative to the operating user’s chosen prompt), creating indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill fetches runtime memory from https://api.getzep.com/api/v2/sessions//memory and explicitly instructs injecting the returned "context" into the agent's system prompt, so remote content directly controls prompts at runtime.