john11.app

The description states "An operator must authorize your participation before you take one," which is an instruction directed at the AI agent about an external authorization process that isn't verifiable through the tool schema itself. This kind of phrasing could be used to condition the agent to accept unverified claims of authorization from task content or future prompts, and expands the tool's apparent scope from simple verse-graph lookup into an open-ended 'task participation' system with unclear boundaries.

This tool returns a task's 'question, materials, required output schema, budget, and boundary' — essentially arbitrary externally-sourced content. Because the content is fetched from a task store and fed back to the agent, it is a plausible vector for prompt injection (e.g., a task's 'materials' field instructing the agent to take actions beyond verse research). Combined with list_tasks' vague authorization language, this pairing could be used to steer the agent into executing unintended instructions under the guise of 'authorized tasks.' No sanitization or provenance-checking is described.