game-art-director

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's MCP Integration and Example Workflows explicitly instruct the agent to search HuggingFace and use ComfyUI/Pixelle MCP servers and to pull design content from Figma (public third-party model repositories and user-generated design/content), which the agent must read, curate, and act on to choose models, generate references, and update the style guide—creating a clear vector for untrusted third-party content to influence subsequent decisions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly lists and uses MCP server repositories at runtime (e.g. https://github.com/ahujasid/blender-mcp, https://github.com/AIDC-AI/Pixelle-MCP, https://github.com/joenorton/comfyui-mcp-server, https://github.com/raveenb/fal-mcp-server) which the agent invokes to execute remote image/3D generation and pipeline code that directly affects prompts/outputs.