tebex-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Required workflow serves a Tebex webhook endpoint where the request body (outsider-authored by Tebex) is read as raw text/bytes and parsed (JSON.parse) into event, so any attacker-controlled webhook payload values can end up in downstream LLM context if the agent later forwards them.