extension-toolchain

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's content scripts (content.ts and injected.js) explicitly read and postMessage with web pages and send page URLs to a background analyzePage routine—i.e., it ingests untrusted public web page content (arbitrary hosts via host_permissions) as part of its workflow, creating exposure to indirect prompt injection.