documenso-data-handling
Warn
Audited by Snyk on Mar 13, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill explicitly calls the Documenso API (client.documents.findV0, getV0, downloadV0) to fetch user-uploaded documents, PDFs and recipient metadata from a third-party service, and those untrusted inputs are used in the workflow to decide actions (archive/delete/retention/DSAR), so external content can materially influence behavior.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata