tauri-impl-build-deploy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's updater workflow (plugins.updater.endpoints in tauri.conf.json and the provided examples referencing GitHub Releases/CDN) plus the check()/downloadAndInstall code in both JavaScript and Rust explicitly fetch and parse remote update JSON and artifacts from public URLs and then take actions (download, install, restart), so untrusted third‑party content can directly influence runtime behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill configures runtime updater endpoints (e.g., https://releases.myapp.com/{{target}}/{{arch}}/{{current_version}} and GitHub release URLs like https://github.com/user/repo/releases/download/v2.0.0/app_2.0.0_x64-setup.exe) which the app's updater checks and then downloads and installs executable artifacts at runtime, meaning remote content is fetched and executed.