mmdx

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly starts a localhost handoff server and embeds its token/endpoint into pako-encoded URLs opened in the remote buildooor viewer (https://buildooor.com/diagrams), and the viewer is expected to POST a "prompt" to the local /send endpoint which the handler then pastes into a tmux pane (see SKILL.md "When --tmux is passed..." and scripts/mmd.py HandoffRequestHandler._handle_send), meaning untrusted third-party page content can drive agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's preflight step auto-installs the Mermaid parser by running "npm install" (pulling packages from https://registry.npmjs.org/ as shown in package-lock.json) and then executes the parser with Node (validate_mermaid.mjs), so remote code from the npm registry can be fetched and executed at runtime.