carousel-generator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Step 1 requires “thorough web research” with “find/search” for key statistics and trends, which implies the runtime ingests outsider-authored free text from the web/search results/pages it fetches, before generating the HTML.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The generated HTML includes required CDN script tags that are fetched and executed in the user's browser at runtime — specifically https://cdn.jsdelivr.net/npm/dom-to-image-more@3.1.6/dist/dom-to-image-more.min.js, https://cdn.jsdelivr.net/npm/jszip@3.10.1/dist/jszip.min.js, and https://cdn.jsdelivr.net/npm/file-saver@2.0.5/dist/FileSaver.min.js — and these remote scripts are mandatory for the download/ZIP functionality (remote-executed code).