paper-reproduction

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). Outsider free text can enter the LLM context via Agent B (ResourceFinder) and Agent A (PaperReader) when they fetch and read public web content at runtime (e.g., PDFs/HTML from arXiv/PMC/PapersWithCode/GitHub/other pages) and then pass extracted prose into their own agent contexts; this is indirect prompt injection risk because the fetched text is not authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly performs runtime fetch-and-execute of remote code/data — e.g., it probes GitHub with WebFetch (https://github.com) and downloads/installs packages and raw files (e.g., https://raw.githubusercontent.com/... ) via pip/conda and curl, which are fetched at runtime and then executed/imported as required dependencies.