notebook

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests public URLs and web content (see SKILL.md "Source Types" and "Workflow: Research" with research_start(source='web') and source_add(..., source_type='url')), then imports and queries those sources as part of artifact generation, which exposes the agent to untrusted third-party content that could carry indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill accepts and fetches arbitrary user-supplied URLs at runtime (e.g., "https://...") via source_add and research_start, and injects that remote content into the notebook context to drive generated prompts/artifacts, meaning external content can directly control the agent's outputs.