travel-itinerary

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the core workflow, the skill’s runtime ingests user-forwarded booking emails/PDFs/screenshots/manual notes at step 1 (“Collect inputs”) and then extracts free-form text into structured fields at step 2 (“Extract structured facts”) without requiring the agent to first pick a specific trusted item.