vapi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The webhook (scripts/webhook.ts) directly ingests untrusted, user-generated content from Vapi webhooks (assistant-request, tool-calls, and end-of-call-report including caller transcripts and toolCall.arguments), inserts that content into the assistant system prompt and downstream actions (createCalendarEvent, checkAvailability, and the Zo "send recap" prompt), so external callers can materially influence tool use and agent behavior.