ecommerce-reviews

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill navigates to a user-supplied public product/reviews page and runs extract-reviews.py, which reads arbitrary outsider-authored review text from the page DOM (e.g., document.querySelectorAll('[data-hook="review"]'), script[type="application/ld+json"], etc.) and returns it into the agent’s LLM context as JSON reviews[].body/title.