forge-connector

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow involves scaffolding and configuring an Atlassian Forge connector app, and the bundled scaffold_connector.py script makes HTTP requests to external APIs fetched via configuration (fetchExternalData), but does not continuously monitor or ingest an outsider-authored message feed or chat source without agent selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The scaffold script runs npm install for @forge/teamwork-graph from the npm registry, which is a common third-party package transporter for an official Atlassian SDK dependency.