documenso-webhooks-events

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md clearly defines a webhook endpoint (app.post("/webhooks/documenso") in "Step 2: Implement Webhook Endpoint") that ingests JSON payloads from external Documenso webhooks and the event handlers (e.g., onDocumentCompleted, onDocumentSigned) parse and act on that user-controlled payload (downloading documents, updating DB, triggering workflows), so untrusted third-party content can materially influence behavior.