w3c-compliant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow validates/passes HTML content to the W3C validator (e.g., via curl ... --data-binary @dist/index.html https://validator.w3.org/nu/?out=json or by extracting page HTML and POSTing it to https://validator.w3.org/nu/?out=json), and that HTML can include outsider-authored free text in the page/source being rendered.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The GitHub Actions workflow references external actions (e.g., "Cyb3r-Jak3/html5validator-action@v7.2.0") which are fetched from GitHub and executed at CI runtime, introducing remote-executed code as a required dependency.