persona-sim

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime, eval/run_eval.py calls sampler.sample_personas(..., mode="stream"), which streams HF dataset rows (e.g., nemotron_usa narratives) and injects the resulting persona_card text into the LLM via generate(system=SYSTEM_PROMPT, persona_card=_persona_card(persona), task=task)—so outsider-authored free text from the external dataset becomes LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The manifest and docs show the skill streams persona narratives at runtime from hf://nvidia/Nemotron-Personas (and related hf:// sources), and those fetched narratives are injected as the prompt backbone/system prompt, so remote HF content directly controls agent prompts.