frontend

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow can drive a real browser to clone a user-supplied live URL and then read runtime-rendered page data (outsider-authored content) via getComputedStyle/DOM sweep, which is then used to generate DESIGN.md and thus enters the LLM context as extracted prose/spec material.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). references/design/lazyweb.md includes a curl-based runtime recipe that POSTS to https://www.lazyweb.com/api/mcp/install-token and calls https://www.lazyweb.com/mcp (used at runtime to fetch search results/images for the "lazyweb" research lane), and the file explicitly warns that the remote tool can embed instruction-shaped text that would try to alter agent instructions — i.e., runtime-fetched content from these URLs can contain prompt-like instructions.