research-prior-art

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's Step 3 "Execute searches" requires the agent to fetch and read/skims abstracts/READMEs from public third-party sources (arXiv, GitHub, blogs, CVE databases, conference talks, etc.), so it ingests untrusted user-generated web content that can influence catalog entries and downstream decisions, enabling indirect prompt injection.