heyapi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill guidance indicates the OpenAPI spec input can be a remote URL/registry shorthand/object/inline spec (e.g., input may be a URL like https://api.example.com/openapi.json or a readme:/scalar: reference), and the codegen runtime will ingest that spec text to generate artifacts.