pdf

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's tools.py clearly allows read_paper to fetch arbitrary HTTP/HTTPS URLs (using httpx in _resolve_source) and to download arXiv papers, then extracts and returns the PDF text (via pdfplumber/PyPDF2), meaning untrusted public documents are ingested and their contents can influence agent decisions.