uber-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow for this skill’s handler reads the HTTP request body and headers from the webhook sender (i.e., Uber/any external caller) and parses it as free text (req.body / request.text() → JSON.parse(...)), which is outsider-authored input that can contain prompt-injection-style content.