auth-md

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow’s “Workflow: Validate” can ingest outsider-authored free text when it loads auth.md “from a local file path or URL” and, at full level, fetches live JSON from /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server (both sourced from user-supplied URLs/endpoints).