paper2reel

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ultimately renders outsider-authored blog prose/blocks and section labels from the user-provided reel bundle into reel.html via the inline ALIGNMENT constant and blogBlocks()/renderBlog() using blogPane.innerHTML and escapeHtml()-escaped text; those JSON fields originate from upstream artifacts that a user can supply in the bundle.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The build script downloads the MathJax tarball at runtime from "https://registry.npmjs.org/mathjax/-/mathjax-{MATHJAX_VERSION}.tgz" (urllib.request.urlretrieve) to localize/extract executable JS for local-open bundles, so a runtime fetch of remote code is performed and required when poster.html references CDN MathJax.