cover-letter-writing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly retrieves and ingests external company/job pages (e.g., SKILL.md "Inputs: Job description text or URL" and "Retrieve company research and validate all facts", plus the company.research [url] command), so it reads untrusted public web content that can influence generated letters.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly accepts and fetches user-provided job-description URLs and company website URLs at runtime (e.g., the "job description URL" / "company website URL" inputs) and uses the fetched content directly to inform and control the prompts/instructions used to generate the cover letter.