shopify-apps

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The extension code extensions/my-extension/src/hooks/useExternalApi.ts performs a fetch to an external API (https://api.example.com/surveys/${surveyId}), ingesting arbitrary third‑party API responses into the extension/UI so the agent would read and act on untrusted external content.