build

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly describes the Maven generate-resources phase that "Downloads RSPEC → deploys to sonar-plugin/javascript-checks/src/main/resources/…" (and requires a GITHUB_TOKEN), meaning the build can fetch external RSPEC JSON from the remote GitHub repo which is ingested and used to generate metadata that affects build outputs and behavior.