dash0-sync-docs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow checks out the source repository (Workflow A) and ingests its Markdown via the transformation engine and the allowlisted files[].source entries from .github/workflows/sync-docs/transformations.yaml, meaning outsider-authored doc text in the source repo is read at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow declares and runs dash0hq/sync-docs-action@ (and uses actions/checkout@v6) which are fetched from GitHub (https://github.com/dash0hq/sync-docs-action) and executed by the runner at workflow runtime, so remote code is fetched and run.