ado-plan-build
Warn
Audited by Snyk on Aug 29, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). The workflow reads Azure DevOps work items, discussion comments, and PR review comments using the
mcp__azure-devops__wit_get_work_item,mcp__azure-devops__wit_list_work_item_comments, andaz boards/az reposCLI commands, which ingest outsider-authored free text from work item descriptions, discussions, and review comments without prior selection.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata