worldos-pax-adaptation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow fetches and decodes Pax Historia content from user-supplied public preset/version identifiers (e.g., via Firestore document reads like https://firestore.googleapis.com/v1/projects/pax-historia-dev/databases/(default)/documents/simplePresets/<preset-id>/versions/<version-id>), so outsider-authored free text from Pax is ingested into the model for transformation into world prompts/state.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bundled fetch/decoder workflow (scripts/fetch-pax-version.py and the curl example) explicitly downloads the Firestore document at https://firestore.googleapis.com/v1/projects/pax-historia-dev/databases/(default)/documents/simplePresets//versions/ at runtime; that document contains Pax "prompts" and source text which are required for the adaptation and can be used to populate or influence generated world prompts, so this is a runtime external dependency that can directly control agent prompts.