resume-cr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, the required workflow loads multiple outsider-authored free-text artifacts (e.g., task-manifest.json-referenced preflight-goal.json, implementation-plan.json, implementation-report.json, qc-report.json, clean-room-result.json, and ledger files) from disk and then validates/uses their JSON contents as LLM context; these files are not guaranteed to be authored by the operating user and can contain narrative text from external contributors.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly tells the runtime to run "npx clean-room-skill@latest run --task-manifest …", which fetches and executes remote npm package code (e.g., from https://registry.npmjs.org/clean-room-skill) at runtime, so external content would be executed and control the agent flow.