literature-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow optionally ingests web excerpts via parallel-cli search and paper extracts, where an outsider can author content on indexed web pages or preprint servers fetched during the search phase.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs installation of an external package from PyPI via uv, which constitutes an operational dependency with common or reputable unofficial publisher provenance.