makepad-splash

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's documentation and examples show Splash making arbitrary HTTP requests (http.get/http.post) and parsing response.json—notably the "AI Workflow Example" calling external endpoints like https://api.example.com and https://ai.api/generate—so the agent can ingest and act on untrusted third-party content.