send-notification

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill’s runtime workflow sends a caller-provided --message/--title/--url through pushover_core.ts and validates/refuses unsafe sizes, but it does not read any outsider-authored free text from external feeds/queues—it only processes the explicit command-line inputs.