web-realtime-sse

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly connects to arbitrary SSE endpoints via EventSource and fetch-based streaming (see SKILL.md and examples like hooks/use-event-source.ts, examples/use-sse.ts and examples/fetch-streaming.md/streamChat), parses event.data/JSON from those streams, and uses that parsed data to drive handlers, UI updates, reconnection logic, and other actions—meaning untrusted, user-generated SSE content could materially influence runtime behavior.