discover

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via run.py → FileSource.collect() reading --items JSONL (user-supplied file content) and core/generate.render_items_block() embedding each item’s text/context_text into the LLM prompt for llm.complete().

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The code makes a runtime POST to the OpenRouter API at https://openrouter.ai/api/v1/chat/completions (in adapters/defaults.py) and directly consumes the LLM response as the single draft output that controls what the agent publishes, so the external endpoint can directly control agent instructions/output.