update-os-coverage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's required workflow explicitly instructs the agent to fetch and parse public web resources (curling raw GitHub URLs such as the dotnet/versions image-info JSON and dotnet/core supported-os.json, and querying endoflife.date) and to use their contents to decide which OS versions to update, so untrusted third‑party content can directly influence tool actions and decisions.