waniwani-sdk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The Initialize playbook (scripts/initialize.md, Step 1a) explicitly instructs launching a background agent to visit a user-provided website and scrape/extract branding, screenshots, navigation, pricing pages and API endpoints and then immediately use that data to scaffold widgets and mocks, which is fetching untrusted third‑party content and using it to drive tool actions and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The embed script at https://cdn.jsdelivr.net/npm/@waniwani/sdk@latest/dist/chat/embed.js is explicitly loaded at runtime (script tag / init()) and executes remote JavaScript in the page — and that embed then fetches remote config from the WaniWani API (e.g. GET https://app.waniwani.ai/api/mcp/chat/config) which can set the agent's systemPrompt/maxSteps — so remote code and remote configuration directly control prompts and are required for the embed widget to function.