mlb-playoff-scheduler

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's mandatory workflow and methodology explicitly instruct the agent to fetch and cite public MLB.com and FanGraphs pages (see "Step 3: Pull each MLB team's schedule" in SKILL.md and the "Schedule Lookup" / "Opponent Quality Scoring" sections in resources/methodology.md), requiring the agent to ingest untrusted third‑party web content that directly drives scoring and downstream decisions.