lazyweb-design-create

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to read and pass opaque/install-fingerprint strings verbatim (the integrity file) and to copy returned imageUrl strings verbatim (which may be signed URLs), which forces the LLM to handle and emit secret/credential-like values in tool-call payloads.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). One high-risk item: the list includes a direct link to an install shell script (https://www.lazyweb.com/install.sh) which the skill instructs users to curl|bash — a classic high-risk distribution vector; the other URLs are image placeholders, example/official API endpoints, or benign pages.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md the required runtime explicitly allows web browsing/capture of arbitrary user-chosen URLs/content (step 7 “Find URLs via WebSearch” + $LB goto ... + $LB snapshot/$LB screenshot), and those fetched page texts/images are then used in the evidence corpus and synthesis into report-data.json/hosted report.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly tells users to run curl -fsSL https://www.lazyweb.com/install.sh | bash to install/upgrade the MCP—this fetches and executes remote code and is presented as a required install/upgrade path when the skill is blocked.