design-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The workflow explicitly requires opening a live preview or staging URL and running Playwright commands (WORKFLOW.md: "playwright-cli open ", Phase 4 axe-core injection via 'https://cdnjs.cloudflare.com/.../axe.min.js' and other eval/snapshot commands), so the agent will fetch and parse arbitrary third‑party web pages/DOM content as part of its decision-making and report generation, exposing it to untrusted user-provided content that could inject instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow injects and executes remote JavaScript at runtime via the axe-core CDN URL (https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.10.2/axe.min.js), which is fetched and run in-page as a required part of the automated accessibility scan.