kibana-vega

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill fetches and parses saved objects and Vega visualization specs from a user-configured Kibana instance (see scripts/kibana-vega.js: kibanaFetch -> /api/saved_objects/_export and formatVisualization reading visState.params.spec) and accepts layout/spec input (stdin or files) that are parsed and then used to create/update dashboards/visualizations (apply-layout, create/update visualizations), so untrusted saved-object/spec content from arbitrary Kibana endpoints can directly influence subsequent tool actions.