mlb-trade-evaluator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required workflow explicitly instructs the agent to fetch and ingest open web content (e.g., "Step 2: Pull rest-of-season ATC projections" from FanGraphs at https://www.fangraphs.com/projections.aspx?type=atcr, plus reading opponent Yahoo team pages, RotoWire injury reports, mlb.com schedules, and other public URLs), and those third-party pages are untrusted public sources whose content is read and directly influences the evaluator's decisions and counter actions.