error-pipeline

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's client tracker (references/tracker.ts and client-init.ts) accepts untrusted, user-generated error reports via navigator.sendBeacon to the site's /api/error-log endpoint (references/error-log-endpoint.ts), and those payloads are logged and consumed by the external notifier Tail Worker which resolves severity and triggers emails/actions — so third-party content can materially influence behavior.