best-practices-cots

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow of best-practices-cots, the operator-provided url (via ./run.sh scan <url> and optional --manifest url:) is navigated by headless Chrome/CDP, and the VLM is asked to analyze cropped UI text/images from that page, meaning outsider-authored free text on the target page is ingested at runtime.