velt-comments-best-practices

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's examples and workflow show the agent/app subscribing to and reading user-generated comment annotations (e.g., useCommentAnnotations and commentElement.getAllCommentAnnotations()/onCommentClick handlers) and using comment context/location to drive actions like seeking video or setting locations (see SKILL.md / AGENTS.full.md examples), which exposes it to untrusted third-party content that could influence behavior.