data-import

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches and parses arbitrary Google Sheets ("fetch from Google Sheets via the Google Sheets MCP" in the "Read and parse source data" step), ingesting user-provided third-party sheet content that the agent reads and uses to decide field mapping, validation, deduplication, and execution behavior, creating a clear vector for indirect prompt-injection via untrusted sheet data.