noteplan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's documentation (references/plugin-development.md "API Reference: fetch()" and references/templates.md "Web Service Tags") explicitly describes plugins/templates calling arbitrary HTTPS web services (e.g., web.quote(), custom web services) whose responses are injected into templates/HTMLViews and processed by plugin code, so untrusted third-party content can be fetched and directly influence note edits, UI actions, and plugin behavior.