implementing-saml-sso-with-okta

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's runtime code and workflow explicitly fetch and parse external IdP metadata and Okta API responses (see scripts/agent.py: _okta_get()/get_saml_metadata calling https://{okta_domain}/api/v1/... and scripts/process.py: _check_metadata_endpoint fetching config.metadata_url), and SKILL.md instructs downloading Okta IdP metadata XML — all of which ingest third-party, potentially untrusted metadata that the agent parses and uses to make validation decisions.