qoderwork-ppt

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/fill-template.js, the skill loads user-authored slide slot values from the generated output/slides.json and directly assigns richtext slot values into HTML via el.innerHTML = value (HTML→PPTX render later), so outsider text can influence the DOM that Puppeteer exports.