cxas-dfcx-migration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly loads arbitrary DFCX agent content via ConversationalAgentsAPI.fetch_full_agent_details (or from a user-provided .zip in scripts/_shared.py and SKILL.md) and then feeds those untrusted, user-generated instructions into CXASOptimizer.optimize_stage1/optimize_stage2 and StructuralConsolidator.synthesize_instructions (see scripts/_optimizer_runner.py and scripts/_synthesis.py), where the content is interpreted and used to drive Gemini calls and redeploy/update-pass actions — so third-party content can materially influence tool use and next actions.