testing-api-for-broken-object-level-authorization

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and parses arbitrary API/web content — for example SKILL.md's curl of https://target-api.example.com/api/docs/swagger.json and scripts/agent.py making requests to the provided base_url and interpreting JSON responses — and those untrusted third-party responses are used to drive vulnerability detection and subsequent actions.