figure-lab

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill generates self-contained HTML that imports D3 from the public CDN (see _d3_cdn_url -> "https://cdn.jsdelivr.net/npm/d3@7/+esm" in composer/_wrap_html) and then executes that HTML in its RENDER sandbox (SKILL.md "Execute in isolated sandbox" / figure_lab.render flow), so the agent's runtime can fetch and execute untrusted third‑party web content which could alter rendered output and thereby influence evaluation, iteration, or promotion decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill generates HTML that imports and will fetch remote JS at runtime from https://cdn.jsdelivr.net/npm/d3@7/+esm (via the import in _wrap_html), which causes execution of remote code during rendering and is a required dependency for composing/rendering the visualizations.