shopify-pos

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill demonstrates runtime ingestion of untrusted third‑party/user-provided content — e.g., scanner/CameraScanner onScan handlers that read arbitrary QR/barcode data, Image components that load external URIs, and example fetch calls to arbitrary backends like https://your-backend.com/api/points — which the extension is expected to read/interpret as part of its workflow.