oce-estimate-boq

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). [Step 3 “Find items” describes the workflow performing cost-item retrieval via provider endpoints like GET /api/v1/costs (q/semantic search), but the skill runtime path shown in the document ingests only user-supplied search queries and selected cost-item fields, i.e., not arbitrary outsider-authored free text from a feed/queue/chat/inbox/issue text reading mechanism.]