hubspot-app-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's runtime instructions and examples explicitly instruct UI extensions to call arbitrary external URLs via hubspot.fetch (see "Fetching External Data" and the Complete Card Example src/app/cards/ContactEnrichment.jsx which calls https://api.example.com/enrich and then JSON-parses and acts on the response), so it clearly ingests untrusted third‑party content that the extension reads and uses to drive UI actions.