azure-pipelines
Warn
Audited by Snyk on Jul 30, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads build metadata, including free-text fields like stage/job names and log/artifact content, from Azure DevOps APIs via
status(and optional--download-log/--download-artifact) without any prior selection of a trusted item, so outsider-authored content in the build (e.g., from committed code or pipeline logs) is ingested for display/download.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata