canvas

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Canvas’s required runtime workflow accepts outsider free text via the browser comment boxes and POSTs it to the canvas server at POST /feedback, which the agent then “reads the latest feedback” and uses for regeneration on wake.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/render_diagram.mjs dynamically imports and (if absent) runs "npm install agentic-mermaid" at runtime, which fetches and executes the remote agentic-mermaid package (see https://github.com/adewale/agentic-mermaid), so the skill can install and run external code during operation.