signals-scout-web-vitals

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow uses execute-sql to query $web_vitals events containing fields like $host, $pathname, and $current_url, which are explicitly described as attacker-controllable telemetry submitted by anyone with the project's public capture token.