circom-remix-zk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow fetches a public Powers-of-Tau file from a specified IPFS URL at runtime during the trusted setup script, but this is a specific URL chosen by the developer/user rather than an automated feed of arbitrary outsider-authored free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The setup script downloads an arbitrary third-party IPFS gateway URL for the Powers-of-Tau file without cryptographic integrity enforcement, constituting a weak external operational dependency.