contract-testing

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's provider verification and CI steps explicitly load and act on consumer-generated pacts from an external Pact Broker (pactBrokerUrl / pact-broker publish and can-i-deploy commands shown in Provider Verification and the GitHub workflow), which ingests third-party/user-generated contract files that directly influence verification and deployment decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow runs "go install github.com/tufin/oasdiff@latest", which fetches and builds remote Go code at runtime (github.com/tufin/oasdiff@latest) and is required to execute the breaking-change check, so it downloads and executes external code during skill runtime.