huggingface-best

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime ingests outsider-authored free text from Hugging Face model cards/tags via first fetching leaderboard and then calling the Hugging Face API for model info (/api/models/...) which returns cardData and is used to extract license/metadata; model card content can be authored by third parties and is LLM-readable.