azure-web-pubsub-ts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s Express runtime path uses WebPubSubEventHandler and handles user-supplied message payloads via handleUserEvent: (req, res) => { ... req.data ... }, meaning outsider/authenticated client text is ingested directly into the workflow at runtime.