caira

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to discover and read live, public files from the CAIRA GitHub repository (e.g., SKILL.md and references/* which list GitHub API endpoints like https://api.github.com/repos/pablozaiden/CAIRA/contents/... and direct the agent to read README.md and *.tf via returned download_url), so untrusted third‑party content from the open web will be fetched and interpreted as part of decision-making.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly directs the agent to inspect and fetch live files from the CAIRA repository at runtime (e.g., https://github.com/pablozaiden/CAIRA and the GitHub contents API like https://api.github.com/repos/pablozaiden/CAIRA/contents/deployment-strategies?ref=main), and those fetched files are used as source-of-truth to drive agent prompts and generated code, so this is a runtime external dependency that can directly control agent behavior.