react-scan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow uses Playwright to load a user-supplied URL and execute step modules, but does not monitor or consume outsider-authored free text from an unselected feed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs fetching a runtime asset from unpkg (https://unpkg.com/react-scan@0.5.7/dist/auto.global.js) which constitutes an external runtime dependency from a common third-party CDN.