[app/visualize] Bundled template loads Lucide from the network despite the no-network contract

Installed version

• Codex Desktop app: 26.810.41047, bundle 6570, macOS arm64
• Bundled Visualize plugin: 1.0.21

Reproduction

The installed Visualize skill says at line 481:

Never load Lucide or another icon library from the network.

Its bundled template at skills/visualize/assets/visualize.html line 225 contains:

<script id="codex-visualization-lucide" async src="https://unpkg.com/lucide@1.17.0/dist/umd/lucide.js"></script>

Lines 229-237 then wait for that network script before initializing icons. No local Lucide asset is bundled under the plugin.

Rendering the template therefore embeds an external unpkg dependency even though the normative skill contract explicitly forbids it. The generated document also requires a CSP exception for that host.

Expected behavior

Visualize output should work offline and under the documented no-network policy, using a sandbox-provided or locally bundled icon implementation.

Actual behavior

Icon rendering depends on a third-party network request. Offline use, a restrictive CSP, or unpkg availability can leave placeholders or missing icons.

Proposed narrow fix

Bundle the pinned icon code with the plugin or use the documented sandbox-provided global. Remove the remote script and its CSP allowance. If network loading is intentionally required, change the skill contract explicitly rather than contradicting it.

Acceptance test

1. Render a fixture with icons while network access is disabled.
2. Assert the output has no external Lucide URL.
3. Assert icon initialization completes and visible icons are present.
4. Add a static check that bundled Visualize assets do not reference unpkg or another remote icon CDN.

This report does not request editing the managed cache; the fix belongs in the upstream bundle/package source.