data-fetching-architecture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s required runtime workflow fetches lender-owned benchmark/dataset fields via SWR hooks calling agentEvalService.listBenchmarks/getBenchmark (e.g., agentEvalService.getBenchmark(id!) in useFetchBenchmarkDetail), where the free-text ingested at runtime is the outsider-authored content returned by those API reads.