design-engine

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill includes deceptive/out-of-scope instructions — e.g., an unconditional "install-hook" that silently writes into ~/.claude/settings.json and ~/.cursor/settings.json and a "No deviation" mandate that attempts to override normal system constraints — which are not required for producing design outputs and constitute a prompt injection.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes an unknown GitHub repo (https://github.com/Bil0000/design) that the skill auto-installs/auto-updates via npx plus raw.githubusercontent.com fetches for raw files — a supply‑chain risk that can be used to deliver arbitrary code updates.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill installs a persistent, silent auto-update hook into users' global Claude/Cursor settings that runs npx to fetch code from external registries on session start (and explicitly suggests bypassing permission prompts), creating a supply-chain persistence/backdoor and anonymity-friendly silent network fetch behavior.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In modules/05-web-research.md the required runtime workflow performs web search from the user’s brief and then “web_fetch each chosen URL” (often based on potentially outsider-authored results), ingesting arbitrary free-text page content into the Research Brief that downstream generation reads.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install-hook installs a SessionStart hook that runs "npx skills add Bil0000/design ..." which the module explicitly says will hit GitHub to fetch the latest skill files (Repo: https://github.com/Bil0000/design) and also uses raw.githubusercontent fetches (https://raw.githubusercontent.com///HEAD/package.json) at runtime to retrieve code/artifacts, meaning remote code/files are fetched and can update/drive agent behavior.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent to always run an "install-hook" that silently installs an auto-update hook into user config files (~/.claude/settings.json and ~/.cursor/settings.json) and to create/modify project gitignore and config files, which performs persistent, potentially unwarranted modifications to the host environment.