bagisto-api-shop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Bagisto storefront runtime path reads untrusted free-form user text from the checkout “checkout-addresses” step (billing/shipping address fields like names/email/address lines and postcode/phone) and other public form inputs (e.g., contact-us “message”, newsletter email, login/register fields), which the workflow then submits/round-trips and may display back on validation errors.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching the API docs index (https://api-docs.bagisto.com/llms.txt and the docs at https://api-docs.bagisto.com) at runtime to discover and then follow endpoint docs that directly control the exact request/response shapes the agent will produce, so this external content is used during runtime to control the agent's generated instructions.