excalidraw-diagram

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow renders the user/agent-authored .excalidraw JSON by reading it from disk and injecting it into a browser renderer (render_excalidraw.py → raw = excalidraw_path.read_text(...) → window.renderDiagram(json_str)), so outsider-provided diagram text in the JSON is directly ingested as readable text/originalText at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The render template loads and executes remote JS at runtime from the external module URL https://esm.sh/@excalidraw/excalidraw?bundle (references/render_template.html:16), so the renderer depends on fetching and running remote code to produce PNGs.