oidc-hosted-page-go

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill directly fetches OIDC provider metadata from the issuer URL (InitOIDC calls oidc.NewProvider with SSOJET_ISSUER_URL and the flow redirects to/authenticates at https://auth.ssojet.com) and then consumes ID tokens/claims in CallbackHandler to create session cookies, so untrusted third‑party responses can materially influence agent behavior.