anydesign

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via the Website URL flow: the skill uses WebFetch/capture_site.py to fetch/render a user-supplied URL and then saves/uses the post-JavaScript rendered HTML (page.content() or locator.outerHTML) as readable text for analysis, which may include arbitrary outsider-authored text from that page.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches arbitrary user-supplied website URLs at runtime (via WebFetch / capture_site.py / extract_css_vars.py) and downloads linked stylesheet URLs (e.g., https:///styles.css or other linked CSS files) whose CSS custom properties are parsed into design tokens that directly drive generated prompts/instructions, so external content fetched from those URLs can control the agent's output.