azure-communication-callautomation-java

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's webhook and event-handling examples (e.g., "Handle Events (Webhook)" / RecognizeCompleted parsing) consume and act on caller-provided speech/DTMF results and the examples show loading/downloading audio from arbitrary URLs (FileSource.setUrl("https://...blob.core.windows.net/...") and callRecording.downloadTo(recordingUrl,...)), which are untrusted, user-generated third‑party contents that can directly influence call flow and subsequent actions.