lisp-to-dotnet

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). templates/acad-lisp-migration/da/Deploy-And-Test-DA.ps1 uploads user-supplied params.example.json/params.json and other inputs into an APS Design Automation WorkItem that the generated plugin later deserializes at runtime, meaning the LLM-exposed free text originates from outsider-provided parameter JSON files.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The PowerShell scripts call Autodesk Platform Services endpoints at runtime (e.g. https://developer.api.autodesk.com/da/us-east/v3, https://developer.api.autodesk.com/oss/v2, https://developer.api.autodesk.com/authentication/v2/token) to obtain tokens, upload bundles, submit WorkItems and trigger remote Design Automation execution, so these external URLs are runtime dependencies that cause remote code/work to run.