htmlit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via client/send.js: user-authored comment/message text (queued from the in-page composer and annotation popover) is sent as prompts[].prompt to the daemon (/api/<KEY>/prompts) along with domSnapshot, and the agent then uses that returned feedback to generate an LLM reply; this is runtime ingestion of outsider-authored text (the user’s own messages/annotations are not “authored by the operating user” in the sense required here).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The client loads external vendor assets at runtime (e.g. loadScript(VENDOR.mermaid) and loadScript(VENDOR.hljsJs), and fetch(hljsLink.href) which uses VENDOR.hljsLight/VENDOR.hljsDark), causing remote JavaScript/CSS to be fetched and executed in-page so these runtime URLs can execute remote code.