kde-plasma-widget-dev

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The SKILL.md includes a concrete "HTTP Requests in QML" example that uses XMLHttpRequest to fetch and JSON-parse data from an external URL (https://api.example.com/data), meaning the widget runtime is expected to ingest and act on open/public third-party content which could influence behavior.