superdesign

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill explicitly mandates automatically fetching and blindly "following the prompt instructions" from external URLs (INIT.md and SUPERDESIGN.md), which can contain hidden or deceptive commands that override the skill's advertised design behavior and thus constitute prompt injection.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains explicit, mandatory instructions to collect and transmit full source files and assets to an external SuperDesign service and to auto-install/run an external CLI, which together constitute deliberate data-exfiltration and supply-chain risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow reads outsider-controlled free text by ingesting repo files and then systematically extracting and passing their full UI code (including markdown/code content) into the design tasks via --context-file (and initial context files like .superdesign/init/* are generated from scanning the same repo), which are not restricted to first-party provider-authored content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly requires fetching and following remote instructions at runtime from https://raw.githubusercontent.com/superdesigndev/superdesign-skill/main/skills/superdesign/INIT.md and https://raw.githubusercontent.com/superdesigndev/superdesign-skill/main/skills/superdesign/SUPERDESIGN.md, which directly control agent prompts/behavior and are mandatory for init, so this is a high-risk runtime dependency.