heroui-migration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow fetches migration documentation from an external URL (e.g., node scripts/get_migration_guide.mjs ... / get_component_migration_guides.mjs / get_styling_migration_guide.mjs), and the fetched MDX text is printed and thus becomes LLM-readable context; this is public web content authored by outsiders.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The included Node scripts fetch migration MDX docs at runtime from https://heroui-git-docs-migration-heroui.vercel.app/docs/react/migration (e.g., ${DOCS_BASE}/{filename}), and that fetched content is directly printed/used as the agent's migration instructions which the skill requires to operate.