copilot-studio

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill explicitly allows adding and crawling "Public websites" as knowledge sources (see knowledge-sources.md "Public Website Configuration") and its grounding/generative-answers flow states the agent retrieves chunks from those indexed sources and passes them to the model as context, meaning untrusted third-party web content can be read and materially influence the agent's decisions and tool selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly configures runtime knowledge sources (e.g., SharePoint site https://contoso.sharepoint.com/sites/HR) that are fetched and passed into the model as grounding/context for generative answers, meaning external content fetched at runtime can directly control prompts and is a required dependency.