android-app-icon

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill queries the public Iconify API for icon search results and metadata, which constitutes low-risk ingestion of third-party community registry data.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The script fetches icon data and SVG files at runtime from the Iconify API (api.iconify.design), but Iconify is a public icon registry transporter rather than an official publisher of the specific icon sets and content retrieved, making it an unofficial operational dependency under tier evaluation.