letterly-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The workflow's exporter (scripts/exporter.py) uses Playwright to log into and download a CSV from the public site https://web.letterly.app, and scripts/processor.py then parses that user-generated CSV content into markdown files which are further processed/linked by the workflow—clearly ingesting untrusted third-party content as part of runtime behavior.