figma-logos-svgl

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses Bash(curl -s ...) to fetch SVG content from the public SVGL API (https://svgl.app/library/...svg), and that fetched SVG string is then passed into use_figma via figma.createNodeFromSvg(svgString), so outsider-authored free text (SVG markup) is ingested into the agent/LLM context.