agentic-mermaid-diagram-workflow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the hosted MCP workflow, the agent can ingest arbitrary user-supplied Mermaid text via the required tools’ source argument (e.g., verify({ source }), describe({ source, ... }), render_svg({ source, ... }), mutate({ source, ops })), meaning outsider-authored free text is directly passed to the runtime without selecting a specific item first.