plan-and-build-dotnet

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill’s required workflow can ingest outsider-authored free text from an Azure Boards work item by fetching System.Title, System.Description (HTML rendered to text), and wit_list_work_item_comments at runtime via wit_get_work_item/wit_list_work_item_comments, then feeding that rendered requirement text into the agent’s planning LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching an Azure Boards work item at the pattern .../_workitems/edit/2 via wit_get_work_item and using its title/description/comments as the brief (so remote content fetched at runtime directly controls the agent's prompts), e.g. .../_workitems/edit/2.