hugging-face-dataset-viewer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill directly calls the public Hugging Face Dataset Viewer API (https://datasets-server.huggingface.co endpoints such as /first-rows, /rows, /search, /filter, /parquet) to fetch dataset rows and metadata that are public/user-contributed and read/interpreted as part of its workflow, so those third-party contents could contain instructions that materially influence agent behavior.