extract-design

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — SKILL.md explicitly says Dembrandt "runs a headless Chromium browser against any URL" (e.g., dembrandt https://stripe.com) and crawls pages (--pages, --sitemap) to read computed DOM/CSS, so it fetches and interprets arbitrary public website content that can materially influence extracted tokens and downstream actions.