goose-graphics

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The script fetch-tweet.js accesses x.com URLs to scrape tweet content, allowing outsider-authored text to be ingested into the agent workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). An operational dependency exists on Google Fonts via HTML link elements fetched at runtime when rendering styles, which represents a common, reputable unofficial/third-party font dependency.