diagrams-js/diagrams-js-plugin-system

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md documents a diagrams-js plugin system where an importer hook consumes a user-provided source string (e.g., import: async (source, diagram, context) => { ... yaml.load(source) ... }), meaning outsider-authored free text can be ingested depending on how the workflow is invoked.