azure-functions-agents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested at runtime via the built-in chat surface (POST /agents/<slug>/chat and POST /agents/<slug>/chatstream), where the request body prompt is sent to the agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches the Azure Functions template manifest at runtime from https://cdn.functions.azure.com/public/templates-manifest/manifest.json (with a GitHub template fallback at https://github.com/Azure-Samples/functions-quickstart-serverless-agents-azd), which the runtime uses to retrieve scaffold files that directly determine agent instructions and code.