syncfusion-aspnetmvc-inline-ai-assist

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required runtime flow is that the component’s promptRequest handler calls inlineAssist.addResponse(...), and the response text is then rendered into the control’s context/UI; since the example shows this response coming from an external AI service (/api/ai or streaming endpoint) it is outsider-provided free text (potentially attacker-controlled) that can be incorporated into the agent/control’s LLM-visible context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs loading remote Syncfusion CDN assets which are fetched at runtime and execute remote code (https://cdn.syncfusion.com/ej2/{{ site.ej2version }}/dist/ej2.min.js and the paired CSS URL), so these external URLs are runtime dependencies that provide executable code required by the component.