experience-cms-brand-apply

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md requires calling get_brand_instructions, which retrieves a promptBody template from Salesforce CMS and then “follow[s] the instructions in promptBody,” meaning CMS-authored brand text is ingested into the agent’s LLM context as free-form prompt content (outsider-authored relative to the operating user’s own text).