design-auditor

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires fetching raw code/URLs and explicitly outputs exact "Before" code snippets and diffs (and even asks users to supply credentials for authenticated audits) without mandated redaction, which creates a direct path for secrets/API keys to be reproduced verbatim in the agent's output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly instructs the agent to fetch and ingest arbitrary live website URLs via web_fetch and public code hosts (GitHub raw files, repos, CodeSandbox/CodePen/Storybook previews) as part of its required "Step 1: Gather the Design" URL Input Spec, and then to read/interpret that content to drive framework detection, code/token extraction, and automated fixes—so untrusted third-party content can materially influence tool use and actions, enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs converting GitHub blob URLs to raw.githubusercontent.com and to fetch those raw files (and similarly to call CodeSandbox's API at codesandbox.io/api/v1/sandboxes/[id]) via web_fetch at runtime and then treat the fetched code as direct input that controls the audit prompts, so raw.githubusercontent.com (and the CodeSandbox API) are runtime dependencies that can inject instructions/code into the agent context.