edu-solid-geometry

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 技能在运行时通过 template/lesson.html 将 generate.py 注入的 __LESSON_DATA__ 解析为 DATA（包含 lesson.title/steps[*].content/answerValue/model.elements 等文本与 LaTeX），然后直接用 innerHTML/textContent 渲染步骤内容与公式，因此如果 __LESSON_DATA__ 可由外部用户自由影响就存在间接提示注入面。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The generated HTML template loads remote JavaScript (Three.js from https://unpkg.com/three@0.160.0/build/three.module.js and its examples path https://unpkg.com/three@0.160.0/examples/jsm/, and MathJax from https://cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.min.js) which will be fetched and execute code in the client at runtime and are required for the page to function.