anima-webhooks-events

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The webhook handler in Step 2 (src/webhooks/figma-handler.ts) directly ingests Figma webhook payloads (event.file_key, file_name, triggered_by, etc.) — untrusted, user-generated third-party content — and uses event.file_key to drive anima.generateCode, so external content can materially influence agent behavior.