customerio-reference-architecture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's Step 4 Webhook Handler (src/webhooks/customerio.ts / the router.post('/') that processes req.body.events from inbound Customer.io webhooks) clearly ingests external, potentially untrusted third-party event payloads and uses their contents to drive actions (emit events, suppress users, stream to a warehouse), so those external payloads can materially influence runtime behavior.