ui-tweaks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow uses a local preview proxy that forwards browser requests and injects the UI-tweaks script into HTML pages served from the dev server, meaning any web content or messages loaded in the running app could potentially reach the agent if pasted or copied.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The repository locator nuthinking/skills provided in README.md line 42 is used by the npx skills installation command to fetch skill material at runtime, establishing a common unofficial operational dependency.