just-bash-executor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). createExecutor’s optional setup path can register outsider-controlled OpenAPI/GraphQL/MCP specs/endpoints into the SDK, which the required workflow then uses at runtime (via sdk.tools.list() and later rawExecutor.tools.invoke()), meaning attacker-authored free text from those sources can be ingested without selecting a specific item first.