ios-icon-gen

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/iconify_gen.sh, the required workflow path search_icons() and generate_icon() constructs Iconify API URLs from runtime user-provided query/icon-id and ingests the resulting free-form JSON/icon fields via curl into the script logic (and SVG contents via curl for PNG conversion), exposing an outsider-to-free-text indirect injection surface.