event-gateway

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests and processes external webhook payloads from third-party providers (e.g., Stripe, Shopify, GitHub) sent to public Source URLs (https://hkdk.events/...) and instructs the agent to verify, parse, and act on those payloads as part of the required workflow (see references/02-scaffold.md, references/03-listen.md, and SKILL.md/examples), so untrusted third-party content can influence routing, transforms, and follow-up actions.