test-interactions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In generate/discover/run the skill navigates to a provided URL and reads live DOM text/attributes (via cdp_client.get_inner_text() and get_text_content() during discovery and assertions), so an outsider can supply the page content that the LLM may later review in the batched /review-design stage.