zerohash-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). Yes—this skill’s required webhook-handling workflow ingests outsider-authored HTTP request body and headers at runtime (e.g., rawBody from the incoming webhook POST), which are then used as readable JSON text (JSON.parse(rawBody)) and thus can include attacker-controlled free text (indirect prompt-injection surface).