expanso-enforce-schema

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Pipeline runtime ingests free-form HTTP request body content via pipeline.yaml’s input.http_server.path: /sensors, stores it as meta original_content = content() and passes it into error handling/mapping (error_message / original_data), which can then be emitted to the DLQ—so outsider-authored text (the sender’s POST payload) reaches the agent’s LLM context.