report-generator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/generate_report.py, the runtime ingests user-supplied JSON files (breakdown_json and optionally hook_analysis_json) from local paths/arguments and directly inserts their free-text fields (e.g., visual_content, *_comment, strengths/weaknesses/suggestions, platform_recommendations[].reason) into the generated Markdown without filtering, so outsiders can submit poison via those inputs.