web-assets-optimization

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). Step 2 ingests outsider-authored free text from the project’s source files by reading them as UTF-8 with scan-assets.py (collect_references() reads each .md/.html/.js/.tsx/... file and extracts matched asset reference strings, including remoteReferences and per-reference raw candidates), and this extracted text is then fed back into the agent via the tool output in Step 3 (--format markdown/json), creating an indirect prompt-injection pathway if those files contain attacker-controlled text.