justanothermusicclient-tauri-youtube-music

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow includes injecting/evaluating JavaScript in a WebView pointed at https://music.youtube.com (outsider-authored web page content), via WebviewWindow.getByLabel('youtube-music') and ytMusicWindow.eval(...), which can cause arbitrary page text/DOM-derived strings to be ingested into the agent/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs users to run a remote installer via curl that is piped to sh (curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh), which fetches and executes remote code during setup.