skeuomorphic-ui

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow uses a reference snapshot from a public URL (Neuform page) and/or demo content, which is outsider-authored free text that can be ingested into the agent’s LLM context via the runtime “reference snapshot”/“included demo/index.html as the visual and interaction reference” path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The demo HTML loads and executes remote JavaScript at runtime (e.g., https://cdn.tailwindcss.com, https://code.iconify.design/iconify-icon/1.0.7/iconify-icon.min.js, https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.2/gsap.min.js and https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.2/ScrollTrigger.min.js), which are required runtime dependencies and thus execute external code in the skill environment.