manage-themes

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to ask for a Claude Design bundle URL and then embed that exact URL in a shell command (--url ) to run an importer, which requires the LLM to receive and output a potentially sensitive handle verbatim and thus risks secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md describes Operation #3 “Grab Theme from Website” using claude-in-chrome to navigate to a user-supplied target URL and then read_page/get_page_text, plus WebSearch for brand context—so arbitrary outsider-authored webpage text is extracted at runtime and then used to generate theme.md, which will later be fed into the agent/LLM context (e.g., in Operations #6 and #9/#8) as readable prompt content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's importer runs at runtime (python3 cogni-workspace/scripts/import-claude-design-bundle.py --url ) to fetch a Claude Design bundle from https://api.anthropic.com/v1/design/h/, materialises the bundle (including theme.md/voice & copy) and that fetched content is later included verbatim in prompts/context, so remote content can directly control agent prompts.