automation-sandbox-post-copy-configure

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Two of the provided URLs embed credentials (one verbatim, one masked) which is a risky pattern — credential-bearing URLs can leak tokens and are commonly abused in unsafe integrations; the remaining hosts are corporate/example domains or API Gateway endpoints (not direct executable downloads) and are not by themselves clear malware-distribution links.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow reads user-authored free text from the local post-copy config JSON file (default ./post-copy-config.json) end-to-end before planning/verifying API candidates, and the values from that file (e.g., ConfigurationName, Label, and Fields) are then ingested at runtime to drive describe/SOQL/GET/PATCH calls.