backend-patterns

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill includes explicit runtime examples that ingest untrusted third‑party content — e.g., supabase/functions/process-webhook/index.ts processes incoming webhook JSON from external sources, and trigger/jobs.ts calls fetchExternalAPI() to fetch and upsert external data — which the code reads and uses to drive downstream actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Supabase Edge Function imports remote modules (https://deno.land/std@0.168.0/http/server.ts and https://esm.sh/@supabase/supabase-js@2) which are fetched/executed at runtime and are required dependencies for the function to run, so they constitute runtime external code execution.